| Server IP : 103.4.122.14 / Your IP : 216.73.216.103 Web Server : Apache/2.4.62 (Unix) OpenSSL/1.0.2k-fips System : Linux cwp2.slnet.com.au 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : statewid ( 1251) PHP Version : 8.3.31 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/local/apache/domlogs/ |
Upload File : |
[Mon Nov 10 18:45:36.533853 2025] [:error] [pid 12498:tid 12559] [client 103.89.235.69:55076] [client 103.89.235.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.89.235.69, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRHCUJftixy1okRgRrVq8gAAAIU"]
[Mon Nov 10 18:45:36.539919 2025] [rewrite:trace3] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] strip per-dir prefix: /home/paramount/public_html/xmlrpc.php -> xmlrpc.php
[Mon Nov 10 18:45:36.539945 2025] [rewrite:trace3] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] applying pattern '^(.*)' to uri 'xmlrpc.php'
[Mon Nov 10 18:45:36.539960 2025] [rewrite:trace2] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] rewrite 'xmlrpc.php' -> 'https://paramountbaldivis.com.au/xmlrpc.php'
[Mon Nov 10 18:45:36.539973 2025] [rewrite:trace2] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] explicitly forcing redirect with https://paramountbaldivis.com.au/xmlrpc.php
[Mon Nov 10 18:45:36.539981 2025] [rewrite:trace2] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] setting lastsub to rule with output https://paramountbaldivis.com.au/$1
[Mon Nov 10 18:45:36.539992 2025] [rewrite:trace1] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] escaping https://paramountbaldivis.com.au/xmlrpc.php for redirect
[Mon Nov 10 18:45:36.540003 2025] [rewrite:trace1] [pid 12498:tid 12559] mod_rewrite.c(505): [client 103.89.235.69:55076] 103.89.235.69 - - [paramountestate.com/sid#3635248][rid#7f80b804fa60/initial] [perdir /home/paramount/public_html/] redirect to https://paramountbaldivis.com.au/xmlrpc.php [REDIRECT/302]
[Mon Nov 10 20:57:50.116125 2025] [:error] [pid 31031:tid 31119] [client 43.157.50.58:38656] [client 43.157.50.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRHhTnI8L5KZTd8nCaZ8lwAAAJA"]
[Tue Nov 11 01:01:30.444727 2025] [:error] [pid 24354:tid 24374] [client 91.92.242.56:49717] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/wp-content/debug.log"] [unique_id "aRIaaiiUwEIL0MTd44PYnQAAApA"]
[Tue Nov 11 01:30:40.119418 2025] [:error] [pid 24103:tid 24116] [client 91.92.242.56:59730] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRIhQLmrGVWhZHx4njJBJgAAAgo"]
[Tue Nov 11 01:38:43.620952 2025] [:error] [pid 24225:tid 24243] [client 91.92.242.56:62020] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRIjI52rrdiHvhXEioV3mAAAAko"]
[Tue Nov 11 01:38:44.687789 2025] [:error] [pid 24554:tid 24569] [client 91.92.242.56:64053] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRIjJBbgcg5JFvN-BGVynwAAAss"]
[Tue Nov 11 01:38:48.907380 2025] [:error] [pid 24817:tid 24825] [client 91.92.242.56:53268] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRIjKOBo1Juuc7yq76DQkgAAAwY"]
[Tue Nov 11 01:38:49.972666 2025] [:error] [pid 41825:tid 41891] [client 91.92.242.56:58270] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIjKYr5hkwmQG_pQgARPQAAAEQ"]
[Tue Nov 11 01:38:51.037267 2025] [:error] [pid 24554:tid 24581] [client 91.92.242.56:60297] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRIjKxbgcg5JFvN-BGVyrwAAAtc"]
[Tue Nov 11 01:38:52.117383 2025] [:error] [pid 24554:tid 24569] [client 91.92.242.56:62630] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIjLBbgcg5JFvN-BGVysgAAAss"]
[Tue Nov 11 01:38:53.229557 2025] [:error] [pid 24225:tid 24243] [client 91.92.242.56:64696] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIjLZ2rrdiHvhXEioV3pQAAAko"]
[Tue Nov 11 01:38:54.302914 2025] [:error] [pid 41825:tid 41899] [client 91.92.242.56:50605] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRIjLor5hkwmQG_pQgARRAAAAEw"]
[Tue Nov 11 01:38:55.375351 2025] [:error] [pid 41825:tid 41897] [client 91.92.242.56:53047] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRIjL4r5hkwmQG_pQgARSQAAAEo"]
[Tue Nov 11 02:19:01.152009 2025] [:error] [pid 41978:tid 42018] [client 43.156.168.214:43622] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRIslZTXUiwDnS4PcJ9QiQAAANg"]
[Tue Nov 11 03:58:20.310840 2025] [:error] [pid 43523:tid 43526] [client 14.225.210.145:60476] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRJD3EpV__NXz9WhMIaM5wAAAMA"]
[Tue Nov 11 03:58:21.076487 2025] [:error] [pid 43435:tid 43459] [client 14.225.210.145:60484] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/env/.env"] [unique_id "aRJD3WeCenDmgzLwDULEFAAAABM"]
[Tue Nov 11 03:58:21.707838 2025] [:error] [pid 43437:tid 43517] [client 14.225.210.145:60492] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "aRJD3QLPT6kbVOb_pwt7ygAAAJY"]
[Tue Nov 11 03:58:22.188375 2025] [:error] [pid 43436:tid 43489] [client 14.225.210.145:60508] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/vendor/.env"] [unique_id "aRJD3tuzjoymDUxEiDgH3wAAAFY"]
[Tue Nov 11 03:58:22.793840 2025] [:error] [pid 43435:tid 43461] [client 14.225.210.145:60524] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api2/.env"] [unique_id "aRJD3meCenDmgzLwDULEFwAAABU"]
[Tue Nov 11 03:58:23.620504 2025] [:error] [pid 43435:tid 43444] [client 14.225.210.145:53376] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRJD32eCenDmgzLwDULEGgAAAAQ"]
[Tue Nov 11 03:58:24.330488 2025] [:error] [pid 43436:tid 43471] [client 14.225.210.145:53392] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/env/.env"] [unique_id "aRJD4NuzjoymDUxEiDgH5gAAAEQ"]
[Tue Nov 11 03:58:25.029660 2025] [:error] [pid 43523:tid 43531] [client 14.225.210.145:53396] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "aRJD4UpV__NXz9WhMIaM7QAAAMU"]
[Tue Nov 11 03:58:25.861685 2025] [:error] [pid 43436:tid 43479] [client 14.225.210.145:53408] [client 14.225.210.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/vendor/.env"] [unique_id "aRJD4duzjoymDUxEiDgH6AAAAEw"]
[Tue Nov 11 08:17:33.736348 2025] [:error] [pid 19559:tid 19563] [client 91.92.242.56:57475] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/wp-content/debug.log"] [unique_id "aRKAnU2A7XQJ15MEH8Ch-QAAAgA"]
[Tue Nov 11 12:08:18.290429 2025] [:error] [pid 59670:tid 59683] [client 213.209.143.137:49254] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2sqk2Cnts0y-hpfqzBgAAAIo"]
[Tue Nov 11 12:08:18.812434 2025] [:error] [pid 53449:tid 53461] [client 213.209.143.137:53960] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2stpz08j5NoUSzp_sXgAAAUc"]
[Tue Nov 11 12:08:23.614018 2025] [:error] [pid 53414:tid 53429] [client 213.209.143.137:55486] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRK2tws6pHd_Z5oc1eczVQAAAQ0"]
[Tue Nov 11 12:08:24.137373 2025] [:error] [pid 59670:tid 59675] [client 213.209.143.137:52774] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRK2uKk2Cnts0y-hpfqzHwAAAII"]
[Tue Nov 11 12:08:24.657760 2025] [:error] [pid 53449:tid 53468] [client 213.209.143.137:54401] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRK2uNpz08j5NoUSzp_segAAAU4"]
[Tue Nov 11 12:08:25.178187 2025] [:error] [pid 59670:tid 59697] [client 213.209.143.137:55819] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRK2uak2Cnts0y-hpfqzJQAAAJg"]
[Tue Nov 11 13:34:02.726847 2025] [:error] [pid 53414:tid 53427] [client 43.164.196.57:38788] [client 43.164.196.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRLKygs6pHd_Z5oc1edS7wAAAQs"]
[Tue Nov 11 20:01:23.307801 2025] [:error] [pid 43205:tid 43223] [client 43.135.135.57:59974] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRMlk748SbhIkX6TjwOROQAAAQ8"]
[Tue Nov 11 20:20:28.132098 2025] [:error] [pid 36673:tid 36697] [client 131.161.66.165:52323] [client 131.161.66.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.161.66.165, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRMqDCvASiSDHs9bkfcVeAAAAJY"]
[Tue Nov 11 21:59:29.455242 2025] [:error] [pid 43205:tid 43213] [client 159.203.76.199:56580] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aRNBQb48SbhIkX6TjwPEAAAAAQU"]
[Tue Nov 11 22:10:50.549591 2025] [:error] [pid 47860:tid 47912] [client 213.209.143.137:51176] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRND6qPe6bkmJWx80CzSZwAAAFU"]
[Tue Nov 11 22:11:02.509818 2025] [:error] [pid 47931:tid 47948] [client 213.209.143.137:56316] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND9jWP7ptQ6Y-gz68eJwAAAU4"]
[Tue Nov 11 22:11:03.030637 2025] [:error] [pid 47964:tid 47983] [client 213.209.143.137:58161] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND916CQC3ebUS5pkQDmQAAAZA"]
[Tue Nov 11 22:11:03.552547 2025] [:error] [pid 47859:tid 47882] [client 213.209.143.137:60587] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND96RzLR7egYHK_4d6cgAAABI"]
[Tue Nov 11 22:11:07.673775 2025] [:error] [pid 47860:tid 47907] [client 213.209.143.137:62684] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aRND-6Pe6bkmJWx80CzSqwAAAFA"]
[Tue Nov 11 22:11:08.193579 2025] [:error] [pid 47859:tid 47883] [client 213.209.143.137:61377] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aRND_KRzLR7egYHK_4d6igAAABM"]
[Tue Nov 11 22:11:08.722574 2025] [:error] [pid 47931:tid 47954] [client 213.209.143.137:63536] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aRND_DWP7ptQ6Y-gz68eXAAAAVQ"]
[Tue Nov 11 22:11:09.245104 2025] [:error] [pid 47931:tid 47945] [client 213.209.143.137:65490] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aRND_TWP7ptQ6Y-gz68eXwAAAUs"]
[Wed Nov 12 00:12:40.693387 2025] [:error] [pid 47859:tid 47881] [client 159.203.76.199:40690] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aRNgeKRzLR7egYHK_4ekqAAAABE"]
[Wed Nov 12 04:20:33.930863 2025] [:error] [pid 57222:tid 57251] [client 213.209.143.137:62975] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROakWGJazH5XCcA91cUDAAAABg"]
[Wed Nov 12 04:20:34.434102 2025] [:error] [pid 57224:tid 57292] [client 213.209.143.137:64975] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROakhs7oZ7imwCSdAnnQQAAAIg"]
[Wed Nov 12 04:20:34.933907 2025] [:error] [pid 57224:tid 57290] [client 213.209.143.137:50805] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROakhs7oZ7imwCSdAnnRQAAAIY"]
[Wed Nov 12 04:44:43.212848 2025] [:error] [pid 57223:tid 57259] [client 117.62.235.53:48458] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aROgOxUU8_2aS__aG8Y3CAAAAEI"]
[Wed Nov 12 12:14:41.680561 2025] [:error] [pid 60097:tid 60174] [client 94.247.172.129:21377] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRQJscdT5oio_TbWpi8GKAAAANU"]
[Wed Nov 12 12:15:08.770195 2025] [:error] [pid 60095:tid 60099] [client 178.18.247.115:54641] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRQJzHlw2elroagFF1rI3AAAAEA"], referer: binance.com
[Wed Nov 12 15:51:44.969465 2025] [:error] [pid 60405:tid 60418] [client 103.78.247.150:50624] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.git/config"] [unique_id "aRQ8kHMGv_mlVi6mf5rJnAAAAAo"]
[Wed Nov 12 15:51:44.969465 2025] [:error] [pid 60096:tid 60136] [client 103.78.247.150:50690] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/frontend/.env"] [unique_id "aRQ8kDmzkhCvvk8DXOx0hQAAAIo"]
[Wed Nov 12 15:51:44.969633 2025] [:error] [pid 60405:tid 60419] [client 103.78.247.150:50692] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "aRQ8kHMGv_mlVi6mf5rJnQAAAAs"]
[Wed Nov 12 15:51:44.970159 2025] [:error] [pid 12744:tid 12763] [client 103.78.247.150:50596] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.git/config"] [unique_id "aRQ8kJ1cp_ouUvkFj0UV0wAAAQ8"]
[Wed Nov 12 15:51:44.971618 2025] [:error] [pid 12744:tid 12750] [client 103.78.247.150:50740] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/backend/.git/config"] [unique_id "aRQ8kJ1cp_ouUvkFj0UV1AAAAQI"]
[Wed Nov 12 15:51:44.971891 2025] [:error] [pid 60097:tid 60162] [client 103.78.247.150:50568] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/html/.git/config"] [unique_id "aRQ8kMdT5oio_TbWpi9KDwAAAMk"]
[Wed Nov 12 15:51:44.971999 2025] [:error] [pid 60095:tid 60102] [client 103.78.247.150:50604] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env"] [unique_id "aRQ8kHlw2elroagFF1oHtgAAAEM"]
[Wed Nov 12 15:51:44.972165 2025] [:error] [pid 60180:tid 60193] [client 103.78.247.150:50702] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRQ8kFhgd7ccS8EZg1oO4QAAAUs"]
[Wed Nov 12 15:51:44.973375 2025] [:error] [pid 60180:tid 60195] [client 103.78.247.150:50664] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "aRQ8kFhgd7ccS8EZg1oO4gAAAU0"]
[Wed Nov 12 15:51:45.011562 2025] [:error] [pid 60405:tid 60424] [client 103.78.247.150:50644] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/laravel/.env"] [unique_id "aRQ8kXMGv_mlVi6mf5rJngAAABA"]
[Wed Nov 12 15:51:45.011634 2025] [:error] [pid 60097:tid 60167] [client 103.78.247.150:50746] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/backend/.env"] [unique_id "aRQ8kcdT5oio_TbWpi9KEAAAAM4"]
[Wed Nov 12 15:51:45.014931 2025] [:error] [pid 60097:tid 60170] [client 103.78.247.150:50582] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.git/config"] [unique_id "aRQ8kcdT5oio_TbWpi9KEQAAANE"]
[Wed Nov 12 15:51:45.015018 2025] [:error] [pid 60097:tid 60174] [client 103.78.247.150:50676] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/public/.git/config"] [unique_id "aRQ8kcdT5oio_TbWpi9KEgAAANU"]
[Wed Nov 12 15:51:45.015118 2025] [:error] [pid 60097:tid 60176] [client 103.78.247.150:50654] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/www/.git/config"] [unique_id "aRQ8kcdT5oio_TbWpi9KEwAAANc"]
[Wed Nov 12 15:51:45.027089 2025] [:error] [pid 60405:tid 60417] [client 103.78.247.150:50592] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.git/config"] [unique_id "aRQ8kXMGv_mlVi6mf5rJnwAAAAk"]
[Wed Nov 12 15:51:45.027963 2025] [:error] [pid 60180:tid 60204] [client 103.78.247.150:50700] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/frontend/.git/config"] [unique_id "aRQ8kVhgd7ccS8EZg1oO4wAAAVY"]
[Wed Nov 12 15:51:45.067202 2025] [:error] [pid 60180:tid 60188] [client 103.78.247.150:50630] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env"] [unique_id "aRQ8kVhgd7ccS8EZg1oO5AAAAUY"]
[Wed Nov 12 15:51:45.067240 2025] [:error] [pid 60405:tid 60425] [client 103.78.247.150:50646] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/laravel/.git/config"] [unique_id "aRQ8kXMGv_mlVi6mf5rJoAAAABE"]
[Wed Nov 12 15:51:45.070421 2025] [:error] [pid 60096:tid 60146] [client 103.78.247.150:50620] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local"] [unique_id "aRQ8kTmzkhCvvk8DXOx0hgAAAJE"]
[Wed Nov 12 15:51:45.105270 2025] [:error] [pid 60180:tid 60197] [client 103.78.247.150:50714] [client 103.78.247.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aRQ8kVhgd7ccS8EZg1oO5QAAAU8"]
[Wed Nov 12 22:28:03.247411 2025] [:error] [pid 60405:tid 60420] [client 45.153.34.41:36608] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aRSZc3MGv_mlVi6mf5osKwAAAAw"]
[Wed Nov 12 22:56:02.937138 2025] [:error] [pid 12744:tid 12767] [client 45.153.34.41:45090] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aRSgAp1cp_ouUvkFj0WXbAAAARM"]
[Thu Nov 13 07:38:07.801729 2025] [:error] [pid 34451:tid 34474] [client 85.203.36.150:24715] [client 85.203.36.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRUaXzRcD8KetQb4RaqpxAAAAVU"]
[Thu Nov 13 10:52:46.158635 2025] [:error] [pid 62217:tid 62291] [client 43.157.156.190:60918] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRVH_hjGU3T9wKBmdNejiwAAAFE"]
[Thu Nov 13 17:55:25.369372 2025] [:error] [pid 44245:tid 44265] [client 66.179.208.155:34772] [client 66.179.208.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/laravel/.env"] [unique_id "aRWrDYk7r-HKZdqw-dXO8QAAAU4"]
[Thu Nov 13 17:55:25.369389 2025] [:error] [pid 44245:tid 44252] [client 66.179.208.155:34784] [client 66.179.208.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/core/.env"] [unique_id "aRWrDYk7r-HKZdqw-dXO8AAAAUE"]
[Thu Nov 13 17:55:25.369929 2025] [:error] [pid 62215:tid 62231] [client 66.179.208.155:34776] [client 66.179.208.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRWrDUvClof1c6XaOBWruAAAAMw"]
[Thu Nov 13 17:55:44.728605 2025] [:error] [pid 62215:tid 62234] [client 150.241.107.255:56783] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRWrIEvClof1c6XaOBWsQQAAAM8"]
[Thu Nov 13 17:55:45.275378 2025] [:error] [pid 6086:tid 6104] [client 150.241.107.255:57044] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRWrIX9_6CRZzjZnAe0zeQAAAQ8"]
[Thu Nov 13 17:55:45.822281 2025] [:error] [pid 62217:tid 62288] [client 150.241.107.255:57443] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIRjGU3T9wKBmdNc2-wAAAE4"]
[Thu Nov 13 18:38:08.527766 2025] [:error] [pid 62216:tid 62248] [client 221.229.106.25:33124] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRW1EOpyFB9M2aVQhwM9iQAAAAE"]
[Thu Nov 13 20:39:10.221156 2025] [:error] [pid 62215:tid 62219] [client 165.232.112.208:50320] [client 165.232.112.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.232.112.208, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aRXRbkvClof1c6XaOBXnwgAAAMA"]
[Thu Nov 13 20:39:11.225822 2025] [:error] [pid 62216:tid 62266] [client 165.232.112.208:50644] [client 165.232.112.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.232.112.208, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aRXRb-pyFB9M2aVQhwNTVgAAABM"]
[Thu Nov 13 22:06:33.758948 2025] [:error] [pid 4992:tid 5012] [client 3.99.167.136:42754] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRXl6SmsutP7nusdj-CITQAAANA"], referer: https://www.google.com/
[Thu Nov 13 22:06:34.187624 2025] [:error] [pid 4994:tid 5058] [client 3.99.167.136:42806] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local"] [unique_id "aRXl6gVaYoYtjfBbabUTagAAAIU"], referer: https://www.google.com/
[Thu Nov 13 22:06:34.618202 2025] [:error] [pid 4993:tid 5032] [client 3.99.167.136:42846] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dev"] [unique_id "aRXl6sl_cC0Js5xNCU1K6wAAAAY"], referer: https://www.google.com/
[Thu Nov 13 22:06:35.051988 2025] [:error] [pid 5086:tid 5112] [client 3.99.167.136:42900] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod"] [unique_id "aRXl6x_dsYLFCHw574iwugAAARc"], referer: https://www.google.com/
[Thu Nov 13 22:06:35.555019 2025] [:error] [pid 5086:tid 5106] [client 3.99.167.136:42946] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging"] [unique_id "aRXl6x_dsYLFCHw574iwvQAAARE"], referer: https://www.google.com/
[Thu Nov 13 22:06:35.982982 2025] [:error] [pid 5086:tid 5097] [client 3.99.167.136:42982] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development"] [unique_id "aRXl6x_dsYLFCHw574iwwAAAAQg"], referer: https://www.google.com/
[Thu Nov 13 22:06:36.415828 2025] [:error] [pid 5086:tid 5095] [client 3.99.167.136:43030] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production"] [unique_id "aRXl7B_dsYLFCHw574iwwwAAAQY"], referer: https://www.google.com/
[Thu Nov 13 22:06:36.857732 2025] [:error] [pid 4994:tid 5061] [client 3.99.167.136:43082] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test"] [unique_id "aRXl7AVaYoYtjfBbabUTbgAAAIg"], referer: https://www.google.com/
[Thu Nov 13 22:06:37.292294 2025] [:error] [pid 4994:tid 5059] [client 3.99.167.136:43126] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup"] [unique_id "aRXl7QVaYoYtjfBbabUTbwAAAIY"], referer: https://www.google.com/
[Thu Nov 13 22:06:37.722488 2025] [:error] [pid 5086:tid 5101] [client 3.99.167.136:43166] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example"] [unique_id "aRXl7R_dsYLFCHw574iwygAAAQw"], referer: https://www.google.com/
[Thu Nov 13 22:06:38.187463 2025] [:error] [pid 5086:tid 5097] [client 3.99.167.136:43218] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample"] [unique_id "aRXl7h_dsYLFCHw574iwywAAAQg"], referer: https://www.google.com/
[Thu Nov 13 22:06:38.615281 2025] [:error] [pid 4992:tid 5014] [client 3.99.167.136:43256] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old"] [unique_id "aRXl7imsutP7nusdj-CIWQAAANI"], referer: https://www.google.com/
[Thu Nov 13 22:06:39.043482 2025] [:error] [pid 4992:tid 5016] [client 3.99.167.136:43310] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.bak"] [unique_id "aRXl7ymsutP7nusdj-CIWgAAANQ"], referer: https://www.google.com/
[Thu Nov 13 22:06:40.852477 2025] [:error] [pid 5086:tid 5101] [client 3.99.167.136:43518] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.orig"] [unique_id "aRXl8B_dsYLFCHw574iw1QAAAQw"], referer: https://www.google.com/
[Thu Nov 13 22:06:41.320214 2025] [:error] [pid 5086:tid 5112] [client 3.99.167.136:43570] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.swp"] [unique_id "aRXl8R_dsYLFCHw574iw2AAAARc"], referer: https://www.google.com/
[Thu Nov 13 22:06:41.794770 2025] [:error] [pid 4993:tid 5040] [client 3.99.167.136:43608] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env~"] [unique_id "aRXl8cl_cC0Js5xNCU1K9QAAAA4"], referer: https://www.google.com/
[Thu Nov 13 22:06:42.260139 2025] [:error] [pid 4993:tid 5027] [client 3.99.167.136:43660] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.tmp"] [unique_id "aRXl8sl_cC0Js5xNCU1K9gAAAAE"], referer: https://www.google.com/
[Thu Nov 13 22:06:42.750439 2025] [:error] [pid 4994:tid 5057] [client 3.99.167.136:43706] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist"] [unique_id "aRXl8gVaYoYtjfBbabUTegAAAIQ"], referer: https://www.google.com/
[Thu Nov 13 22:06:43.259215 2025] [:error] [pid 4994:tid 5070] [client 3.99.167.136:43748] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env"] [unique_id "aRXl8wVaYoYtjfBbabUTfQAAAJE"], referer: https://www.google.com/
[Thu Nov 13 22:06:43.741413 2025] [:error] [pid 4994:tid 5060] [client 3.99.167.136:43798] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env.save"] [unique_id "aRXl8wVaYoYtjfBbabUTgAAAAIc"], referer: https://www.google.com/
[Thu Nov 13 22:06:44.206238 2025] [:error] [pid 4992:tid 5005] [client 3.99.167.136:43850] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env.bak"] [unique_id "aRXl9CmsutP7nusdj-CIbwAAAMk"], referer: https://www.google.com/
[Thu Nov 13 22:06:44.702442 2025] [:error] [pid 4994:tid 5071] [client 3.99.167.136:43882] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env.old"] [unique_id "aRXl9AVaYoYtjfBbabUTggAAAJI"], referer: https://www.google.com/
[Thu Nov 13 22:06:45.132634 2025] [:error] [pid 4994:tid 5067] [client 3.99.167.136:43948] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "aRXl9QVaYoYtjfBbabUTgwAAAI4"], referer: https://www.google.com/
[Thu Nov 13 22:06:45.569517 2025] [:error] [pid 4994:tid 5064] [client 3.99.167.136:43982] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env.save"] [unique_id "aRXl9QVaYoYtjfBbabUThAAAAIs"], referer: https://www.google.com/
[Thu Nov 13 22:06:46.051609 2025] [:error] [pid 4994:tid 5059] [client 3.99.167.136:44038] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env.bak"] [unique_id "aRXl9gVaYoYtjfBbabUThQAAAIY"], referer: https://www.google.com/
[Thu Nov 13 22:06:46.524602 2025] [:error] [pid 4993:tid 5040] [client 3.99.167.136:44104] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env.old"] [unique_id "aRXl9sl_cC0Js5xNCU1K_wAAAA4"], referer: https://www.google.com/
[Thu Nov 13 22:06:47.045136 2025] [:error] [pid 4993:tid 5027] [client 3.99.167.136:44160] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "aRXl98l_cC0Js5xNCU1LAQAAAAE"], referer: https://www.google.com/
[Thu Nov 13 22:06:47.480318 2025] [:error] [pid 4992:tid 5020] [client 3.99.167.136:44218] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env.save"] [unique_id "aRXl9ymsutP7nusdj-CIcgAAANg"], referer: https://www.google.com/
[Thu Nov 13 22:06:47.977263 2025] [:error] [pid 5086:tid 5113] [client 3.99.167.136:44256] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env.bak"] [unique_id "aRXl9x_dsYLFCHw574iw7gAAARg"], referer: https://www.google.com/
[Thu Nov 13 22:06:48.454467 2025] [:error] [pid 5086:tid 5105] [client 3.99.167.136:44296] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env.old"] [unique_id "aRXl-B_dsYLFCHw574iw8QAAARA"], referer: https://www.google.com/
[Thu Nov 13 22:06:48.936611 2025] [:error] [pid 4994:tid 5064] [client 3.99.167.136:44350] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env"] [unique_id "aRXl-AVaYoYtjfBbabUTiwAAAIs"], referer: https://www.google.com/
[Thu Nov 13 22:06:49.416083 2025] [:error] [pid 4992:tid 5011] [client 3.99.167.136:44410] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env.save"] [unique_id "aRXl-SmsutP7nusdj-CIeQAAAM8"], referer: https://www.google.com/
[Thu Nov 13 22:06:49.963955 2025] [:error] [pid 4993:tid 5033] [client 3.99.167.136:44460] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env.bak"] [unique_id "aRXl-cl_cC0Js5xNCU1LBAAAAAc"], referer: https://www.google.com/
[Thu Nov 13 22:06:50.438315 2025] [:error] [pid 4993:tid 5035] [client 3.99.167.136:44510] [client 3.99.167.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env.old"] [unique_id "aRXl-sl_cC0Js5xNCU1LBgAAAAk"], referer: https://www.google.com/
[Thu Nov 13 23:13:07.993046 2025] [:error] [pid 4994:tid 5057] [client 3.250.45.197:43372] [client 3.250.45.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aRX1gwVaYoYtjfBbabUlVAAAAIQ"]
[Thu Nov 13 23:18:06.780631 2025] [:error] [pid 5086:tid 5104] [client 52.67.239.112:38110] [client 52.67.239.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aRX2rh_dsYLFCHw574jHwwAAAQ8"]
[Thu Nov 13 23:25:31.792641 2025] [:error] [pid 4993:tid 5032] [client 172.210.164.199:12228] [client 172.210.164.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRX4a8l_cC0Js5xNCU1h2AAAAAY"]
[Thu Nov 13 23:25:32.333742 2025] [:error] [pid 4994:tid 5069] [client 172.210.164.199:12241] [client 172.210.164.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRX4bAVaYoYtjfBbabUpXgAAAJA"]
[Thu Nov 13 23:25:33.243707 2025] [:error] [pid 4992:tid 5010] [client 172.210.164.199:12235] [client 172.210.164.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRX4bSmsutP7nusdj-CevAAAAM4"]
[Thu Nov 13 23:25:33.970660 2025] [:error] [pid 4992:tid 4997] [client 172.210.164.199:12275] [client 172.210.164.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRX4bSmsutP7nusdj-CevgAAAME"]
[Fri Nov 14 00:14:38.995937 2025] [:error] [pid 56586:tid 56595] [client 43.166.250.187:33938] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRYD7q7eYD3G9deYMP4e8QAAAYQ"]
[Fri Nov 14 01:18:11.831881 2025] [:error] [pid 56495:tid 56499] [client 159.223.72.153:55947] [client 159.223.72.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "aRYS01wO8wZZL5WJceW7JAAAAMA"]
[Fri Nov 14 04:41:48.041737 2025] [:error] [pid 47242:tid 47264] [client 49.207.56.21:45699] [client 49.207.56.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.56.21, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRZCjFPNnvrux3OMagxiVwAAANM"]
[Fri Nov 14 06:40:12.150516 2025] [:error] [pid 47242:tid 47262] [client 2.57.122.173:46460] [client 2.57.122.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aRZeTFPNnvrux3OMagydOQAAANE"]
[Fri Nov 14 07:28:48.256906 2025] [:error] [pid 47155:tid 47191] [client 180.110.203.108:43098] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRZpsJipxRXMZJH8hmgVlQAAAEU"]
[Fri Nov 14 15:50:24.210605 2025] [:error] [pid 16575:tid 16657] [client 43.166.247.155:59404] [client 43.166.247.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRbfQO6qT670YxigvbBcZgAAANc"]
[Fri Nov 14 18:50:23.718004 2025] [:error] [pid 16573:tid 16588] [client 170.106.179.68:49092] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRcJbyPGexfUk9FDoEKmVAAAAEo"]
[Sat Nov 15 00:44:24.562157 2025] [:error] [pid 45908:tid 45949] [client 43.157.156.190:57148] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRdcaGWG19mWwZX7KatUmQAAAAs"]
[Sat Nov 15 00:46:36.483492 2025] [:error] [pid 45908:tid 45960] [client 34.23.179.107:51664] [client 34.23.179.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aRdc7GWG19mWwZX7KatVWwAAABY"]
[Sat Nov 15 00:53:52.364588 2025] [:error] [pid 45995:tid 46017] [client 49.150.102.20:56668] [client 49.150.102.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.150.102.20, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRdeoMfhZrb6EV4SvFu2AQAAAhE"]
[Sat Nov 15 01:24:04.611459 2025] [:error] [pid 45908:tid 45941] [client 159.65.14.149:60923] [client 159.65.14.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "aRdltGWG19mWwZX7KathsAAAAAM"]
[Sat Nov 15 02:36:59.561963 2025] [:error] [pid 18513:tid 18520] [client 223.244.35.77:59242] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRd2y_c94upQFzRWlUns0gAAAEI"]
[Sat Nov 15 02:55:36.020396 2025] [:error] [pid 45909:tid 45986] [client 4.205.211.97:15237] [client 4.205.211.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRd7KMZqItrYybG86ki28QAAAdU"]
[Sat Nov 15 02:55:37.986282 2025] [:error] [pid 45909:tid 45965] [client 4.205.211.97:15324] [client 4.205.211.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRd7KcZqItrYybG86ki29QAAAcA"]
[Sat Nov 15 02:55:38.644562 2025] [:error] [pid 45909:tid 45966] [client 4.205.211.97:15248] [client 4.205.211.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRd7KsZqItrYybG86ki29gAAAcE"]
[Sat Nov 15 02:55:39.599359 2025] [:error] [pid 18513:tid 18532] [client 4.205.211.97:15340] [client 4.205.211.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "aRd7K_c94upQFzRWlUn2XwAAAE4"]
[Sat Nov 15 03:46:23.263028 2025] [:error] [pid 10489:tid 10510] [client 170.106.37.134:48180] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aReHD1ckOpF1_1u6OZzBRwAAANA"]
[Sat Nov 15 04:33:14.678638 2025] [:error] [pid 37318:tid 37368] [client 4.206.94.204:24896] [client 4.206.94.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aReSCugM1rHoEAqoQDcBywAAAQY"]
[Sat Nov 15 04:33:15.088846 2025] [:error] [pid 27911:tid 27969] [client 4.206.94.204:25453] [client 4.206.94.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aReSC8GzUdrhGBIfiKSm5gAAAIE"]
[Sat Nov 15 04:33:15.500476 2025] [:error] [pid 27909:tid 27913] [client 4.206.94.204:25416] [client 4.206.94.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aReSCyTfZ6B57n8HepVz2wAAAAA"]
[Sat Nov 15 04:33:15.924992 2025] [:error] [pid 27911:tid 27976] [client 4.206.94.204:25458] [client 4.206.94.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aReSC8GzUdrhGBIfiKSm5wAAAIg"]
[Sat Nov 15 05:04:17.222458 2025] [:error] [pid 37318:tid 37367] [client 162.243.15.109:45292] [client 162.243.15.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aReZUegM1rHoEAqoQDcQqAAAAQU"]
[Sat Nov 15 05:04:18.285376 2025] [:error] [pid 27909:tid 27924] [client 162.243.15.109:45368] [client 162.243.15.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aReZUiTfZ6B57n8HepV-kQAAAAs"]
[Sat Nov 15 12:09:26.276902 2025] [:error] [pid 22765:tid 22789] [client 138.197.23.42:64590] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRf89qbrQzjuZmPIWDae-gAAApM"]
[Sat Nov 15 12:09:26.726819 2025] [:error] [pid 27997:tid 28018] [client 138.197.23.42:64754] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRf89tpja_6cDxKbxFmOBQAAANM"]
[Sat Nov 15 12:09:27.177360 2025] [:error] [pid 27997:tid 28001] [client 138.197.23.42:64906] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRf899pja_6cDxKbxFmOLAAAAMI"]
[Sat Nov 15 12:09:27.619758 2025] [:error] [pid 27997:tid 28008] [client 138.197.23.42:65090] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRf899pja_6cDxKbxFmOUAAAAMk"]
[Sat Nov 15 12:09:28.048913 2025] [:error] [pid 22765:tid 22794] [client 138.197.23.42:65261] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRf8-KbrQzjuZmPIWDafSgAAApg"]
[Sat Nov 15 15:08:54.088579 2025] [:error] [pid 20313:tid 20318] [client 182.44.2.148:42422] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRgnBhI9DXIgPadBLUZuNwAAAsI"]
[Sat Nov 15 17:31:40.155357 2025] [:error] [pid 22613:tid 22629] [client 20.2.83.141:65069] [client 20.2.83.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/"] [unique_id "aRhIfCoyR3cDsIRGPRm2LAAAAg4"], referer: binance.com
[Sat Nov 15 20:26:27.355771 2025] [:error] [pid 19961:tid 20012] [client 45.134.79.103:63810] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRhxczar7Si-84EApVSFlwAAAdM"]
[Sat Nov 15 20:26:27.998819 2025] [:error] [pid 20654:tid 20675] [client 45.134.79.103:64079] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRhxc3cS7eC8vO76_ycI6QAAA5I"]
[Sat Nov 15 20:26:28.657315 2025] [:error] [pid 19961:tid 19994] [client 45.134.79.103:64266] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRhxdDar7Si-84EApVSFtgAAAcE"]
[Sat Nov 15 22:18:24.170574 2025] [:error] [pid 19959:tid 19971] [client 49.206.128.104:30928] [client 49.206.128.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.128.104, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRiLsMjejiTUP1-IawP_UgAAAYU"]
[Sat Nov 15 22:18:28.776929 2025] [:error] [pid 20654:tid 20671] [client 191.177.193.101:15039] [client 191.177.193.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.177.193.101, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRiLtHcS7eC8vO76_ycfuQAAA44"]
[Sat Nov 15 22:25:12.108070 2025] [:error] [pid 22613:tid 22632] [client 157.51.16.188:44087] [client 157.51.16.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.51.16.188, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRiNSCoyR3cDsIRGPRng9gAAAhE"]
[Sun Nov 16 08:17:43.131570 2025] [:error] [pid 52471:tid 52539] [client 43.131.243.61:46850] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRkYJ9mWsFzjR5CEgDXLoAAAAIc"]
[Sun Nov 16 10:59:21.479895 2025] [:error] [pid 52470:tid 52510] [client 222.79.103.59:52961] [client 222.79.103.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRk-CUg9mXF2ZFFtj1UWLAAAAEU"]
[Sun Nov 16 19:59:09.393080 2025] [:error] [pid 34227:tid 34234] [client 52.64.116.35:48338] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aRm8jX108zGLYs9eMuhIBAAAAgU"]
[Sun Nov 16 19:59:10.087618 2025] [:error] [pid 34301:tid 34312] [client 52.64.116.35:48352] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod"] [unique_id "aRm8jrGPoZwUGuFNREvcbQAAAog"]
[Sun Nov 16 19:59:10.117019 2025] [:error] [pid 34227:tid 34240] [client 52.64.116.35:48356] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dev"] [unique_id "aRm8jn108zGLYs9eMuhIBQAAAgs"]
[Sun Nov 16 19:59:10.155662 2025] [:error] [pid 52471:tid 52547] [client 52.64.116.35:48340] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local"] [unique_id "aRm8jtmWsFzjR5CEgDVqdAAAAI8"]
[Sun Nov 16 19:59:25.760727 2025] [:error] [pid 34165:tid 34208] [client 52.64.116.35:45910] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging"] [unique_id "aRm8nXhG2YTKEjXchwk4JgAAAc0"]
[Sun Nov 16 19:59:33.307590 2025] [:error] [pid 34165:tid 34200] [client 52.64.116.35:45984] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development"] [unique_id "aRm8pXhG2YTKEjXchwk4LAAAAcU"]
[Sun Nov 16 19:59:33.332504 2025] [:error] [pid 34271:tid 34287] [client 52.64.116.35:46000] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup"] [unique_id "aRm8pUNmlZhoZZV1BUDMOAAAAk4"]
[Sun Nov 16 19:59:33.363767 2025] [:error] [pid 34271:tid 34296] [client 52.64.116.35:46014] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test"] [unique_id "aRm8pUNmlZhoZZV1BUDMOQAAAlc"]
[Sun Nov 16 19:59:33.373026 2025] [:error] [pid 34165:tid 34209] [client 52.64.116.35:46006] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env~"] [unique_id "aRm8pXhG2YTKEjXchwk4LQAAAc4"]
[Sun Nov 16 19:59:33.388084 2025] [:error] [pid 34271:tid 34279] [client 52.64.116.35:46004] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production"] [unique_id "aRm8pUNmlZhoZZV1BUDMOgAAAkY"]
[Sun Nov 16 19:59:37.025435 2025] [:error] [pid 52469:tid 52479] [client 52.64.116.35:42104] [client 52.64.116.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample"] [unique_id "aRm8qU6HaXpHeEZ98Z35IAAAAAI"]
[Sun Nov 16 22:03:54.159909 2025] [:error] [pid 34301:tid 34308] [client 43.156.202.34:37460] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRnZyrGPoZwUGuFNREv0iQAAAoQ"]
[Mon Nov 17 02:01:02.543001 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:41969] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "aRoRXg3NjAS-v6ul5QBz3AAAAMo"]
[Mon Nov 17 02:01:02.927639 2025] [:error] [pid 55655:tid 55682] [client 74.176.64.167:41971] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "aRoRXiGT_hu1vaVuRSR-gQAAABc"]
[Mon Nov 17 02:01:03.337960 2025] [:error] [pid 55655:tid 55659] [client 74.176.64.167:41974] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "aRoRXyGT_hu1vaVuRSR-ggAAAAA"]
[Mon Nov 17 02:01:03.616018 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41865] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "aRoRXyGT_hu1vaVuRSR-gwAAABQ"]
[Mon Nov 17 02:01:03.985967 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41931] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass4.php"] [unique_id "aRoRXyGT_hu1vaVuRSR-hAAAAAE"]
[Mon Nov 17 02:01:04.251465 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:41856] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass4.php"] [unique_id "aRoRYIZk0eT801XQsauJEQAAAEQ"]
[Mon Nov 17 02:01:04.564307 2025] [:error] [pid 55657:tid 55720] [client 74.176.64.167:41983] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass4.php"] [unique_id "aRoRYB2pywrNN427_XRO6gAAAck"]
[Mon Nov 17 02:01:04.832605 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:41932] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass4.php"] [unique_id "aRoRYCGT_hu1vaVuRSR-iAAAAAc"]
[Mon Nov 17 02:01:05.101851 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:41927] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "aRoRYQ3NjAS-v6ul5QBz3gAAANU"]
[Mon Nov 17 02:01:05.431606 2025] [:error] [pid 55657:tid 55709] [client 74.176.64.167:41866] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "aRoRYR2pywrNN427_XRO6wAAAcM"]
[Mon Nov 17 02:01:05.706646 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:41925] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "aRoRYQ3NjAS-v6ul5QBz4QAAANc"]
[Mon Nov 17 02:01:05.967484 2025] [:error] [pid 55655:tid 55664] [client 74.176.64.167:41972] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "aRoRYSGT_hu1vaVuRSR-jAAAAAU"]
[Mon Nov 17 02:01:06.253017 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41929] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "aRoRYiGT_hu1vaVuRSR-jQAAAAE"]
[Mon Nov 17 02:01:06.560920 2025] [:error] [pid 55657:tid 55712] [client 74.176.64.167:41874] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "aRoRYh2pywrNN427_XRO7QAAAcQ"]
[Mon Nov 17 02:01:06.871888 2025] [:error] [pid 65480:tid 343] [client 74.176.64.167:41921] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "aRoRYg3NjAS-v6ul5QBz5AAAANI"]
[Mon Nov 17 02:01:07.296069 2025] [:error] [pid 55655:tid 55676] [client 74.176.64.167:41957] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "aRoRYyGT_hu1vaVuRSR-kQAAABE"]
[Mon Nov 17 02:01:07.591775 2025] [:error] [pid 65480:tid 333] [client 74.176.64.167:41934] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless5.php"] [unique_id "aRoRYw3NjAS-v6ul5QBz5gAAAMs"]
[Mon Nov 17 02:01:07.929721 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:41958] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless5.php"] [unique_id "aRoRYw3NjAS-v6ul5QBz6AAAAMI"]
[Mon Nov 17 02:01:08.351230 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:41946] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless5.php"] [unique_id "aRoRZCGT_hu1vaVuRSR-kwAAAAk"]
[Mon Nov 17 02:01:08.590675 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41949] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless5.php"] [unique_id "aRoRZCGT_hu1vaVuRSR-lAAAABQ"]
[Mon Nov 17 02:01:08.994452 2025] [:error] [pid 55745:tid 55752] [client 74.176.64.167:41891] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file15.php"] [unique_id "aRoRZIZk0eT801XQsauJFgAAAEU"]
[Mon Nov 17 02:01:09.327948 2025] [:error] [pid 55657:tid 55726] [client 74.176.64.167:41899] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file15.php"] [unique_id "aRoRZR2pywrNN427_XRO8AAAAc0"]
[Mon Nov 17 02:01:09.885472 2025] [:error] [pid 55745:tid 55759] [client 74.176.64.167:41947] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file15.php"] [unique_id "aRoRZYZk0eT801XQsauJGAAAAEw"]
[Mon Nov 17 02:01:10.261882 2025] [:error] [pid 55655:tid 55669] [client 74.176.64.167:41871] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file15.php"] [unique_id "aRoRZiGT_hu1vaVuRSR-mQAAAAo"]
[Mon Nov 17 02:01:10.500900 2025] [:error] [pid 55657:tid 55737] [client 74.176.64.167:41980] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/333.php"] [unique_id "aRoRZh2pywrNN427_XRO9wAAAdg"]
[Mon Nov 17 02:01:10.805099 2025] [:error] [pid 55745:tid 55754] [client 74.176.64.167:41858] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/333.php"] [unique_id "aRoRZoZk0eT801XQsauJGwAAAEc"]
[Mon Nov 17 02:01:11.113776 2025] [:error] [pid 55655:tid 55667] [client 74.176.64.167:41884] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/333.php"] [unique_id "aRoRZyGT_hu1vaVuRSR-mgAAAAg"]
[Mon Nov 17 02:01:11.473715 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41933] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/333.php"] [unique_id "aRoRZyGT_hu1vaVuRSR-nAAAAAE"]
[Mon Nov 17 02:01:11.778284 2025] [:error] [pid 55657:tid 55713] [client 74.176.64.167:41970] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpa.php"] [unique_id "aRoRZx2pywrNN427_XRO-gAAAcU"]
[Mon Nov 17 02:01:12.039761 2025] [:error] [pid 55657:tid 55709] [client 74.176.64.167:41959] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpa.php"] [unique_id "aRoRaB2pywrNN427_XRO-wAAAcM"]
[Mon Nov 17 02:01:12.392288 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:41918] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpa.php"] [unique_id "aRoRaCGT_hu1vaVuRSR-nQAAAAk"]
[Mon Nov 17 02:01:12.676217 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:41944] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpa.php"] [unique_id "aRoRaA3NjAS-v6ul5QBz8AAAANQ"]
[Mon Nov 17 02:01:12.918009 2025] [:error] [pid 55656:tid 55701] [client 74.176.64.167:41876] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "aRoRaKZDObyEN97tsHBkXwAAAI4"]
[Mon Nov 17 02:01:13.186303 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:41879] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "aRoRaQ3NjAS-v6ul5QBz8gAAAM0"]
[Mon Nov 17 02:01:13.471878 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:41938] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "aRoRaQ3NjAS-v6ul5QBz9AAAANY"]
[Mon Nov 17 02:01:13.783878 2025] [:error] [pid 55745:tid 55747] [client 74.176.64.167:41950] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "aRoRaYZk0eT801XQsauJHAAAAEA"]
[Mon Nov 17 02:01:14.093397 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:41976] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ut.php"] [unique_id "aRoRaqZDObyEN97tsHBkYgAAAIw"]
[Mon Nov 17 02:01:14.600760 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:41975] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ut.php"] [unique_id "aRoRaiGT_hu1vaVuRSR-nwAAAA4"]
[Mon Nov 17 02:01:14.950011 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:41869] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ut.php"] [unique_id "aRoRaqZDObyEN97tsHBkYwAAAIs"]
[Mon Nov 17 02:01:15.385290 2025] [:error] [pid 55745:tid 55758] [client 74.176.64.167:41877] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ut.php"] [unique_id "aRoRa4Zk0eT801XQsauJHgAAAEs"]
[Mon Nov 17 02:01:15.781748 2025] [:error] [pid 55745:tid 55768] [client 74.176.64.167:41878] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inde.php"] [unique_id "aRoRa4Zk0eT801XQsauJHwAAAFU"]
[Mon Nov 17 02:01:16.454919 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41940] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inde.php"] [unique_id "aRoRbCGT_hu1vaVuRSR-pAAAABQ"]
[Mon Nov 17 02:01:16.860185 2025] [:error] [pid 55745:tid 55752] [client 74.176.64.167:41962] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inde.php"] [unique_id "aRoRbIZk0eT801XQsauJIgAAAEU"]
[Mon Nov 17 02:01:17.279181 2025] [:error] [pid 55745:tid 55756] [client 74.176.64.167:41973] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inde.php"] [unique_id "aRoRbYZk0eT801XQsauJIwAAAEk"]
[Mon Nov 17 02:01:17.543606 2025] [:error] [pid 55655:tid 55674] [client 74.176.64.167:41923] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classgoto24.php"] [unique_id "aRoRbSGT_hu1vaVuRSR-pgAAAA8"]
[Mon Nov 17 02:01:17.914205 2025] [:error] [pid 55656:tid 55690] [client 74.176.64.167:41905] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classgoto24.php"] [unique_id "aRoRbaZDObyEN97tsHBkZwAAAIQ"]
[Mon Nov 17 02:01:18.189578 2025] [:error] [pid 55656:tid 55718] [client 74.176.64.167:41919] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classgoto24.php"] [unique_id "aRoRbqZDObyEN97tsHBkaAAAAJc"]
[Mon Nov 17 02:01:18.493806 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:41937] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classgoto24.php"] [unique_id "aRoRbg3NjAS-v6ul5QB0AgAAAM8"]
[Mon Nov 17 02:01:18.905282 2025] [:error] [pid 55745:tid 55749] [client 74.176.64.167:41953] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "aRoRboZk0eT801XQsauJJAAAAEI"]
[Mon Nov 17 02:01:19.270411 2025] [:error] [pid 55745:tid 55771] [client 74.176.64.167:41805] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "aRoRb4Zk0eT801XQsauJJgAAAFg"]
[Mon Nov 17 02:01:19.553512 2025] [:error] [pid 65480:tid 320] [client 74.176.64.167:41966] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "aRoRbw3NjAS-v6ul5QB0BgAAAMA"]
[Mon Nov 17 02:01:19.898152 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:41800] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "aRoRb4Zk0eT801XQsauJKAAAAFc"]
[Mon Nov 17 02:01:20.172401 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:41945] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "aRoRcCGT_hu1vaVuRSR-pwAAAAQ"]
[Mon Nov 17 02:01:20.512781 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:41859] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "aRoRcA3NjAS-v6ul5QB0CAAAAMg"]
[Mon Nov 17 02:01:20.925452 2025] [:error] [pid 65480:tid 321] [client 74.176.64.167:41872] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "aRoRcA3NjAS-v6ul5QB0CgAAAME"]
[Mon Nov 17 02:01:21.201573 2025] [:error] [pid 55656:tid 55701] [client 74.176.64.167:41967] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "aRoRcaZDObyEN97tsHBkaQAAAI4"]
[Mon Nov 17 02:01:21.455618 2025] [:error] [pid 55656:tid 55691] [client 74.176.64.167:41870] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indo.php"] [unique_id "aRoRcaZDObyEN97tsHBkagAAAIU"]
[Mon Nov 17 02:01:21.743738 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:41860] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indo.php"] [unique_id "aRoRcR2pywrNN427_XRPAwAAAcg"]
[Mon Nov 17 02:01:22.161773 2025] [:error] [pid 55655:tid 55669] [client 74.176.64.167:41837] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indo.php"] [unique_id "aRoRciGT_hu1vaVuRSR-qgAAAAo"]
[Mon Nov 17 02:01:22.452406 2025] [:error] [pid 65480:tid 335] [client 74.176.64.167:41907] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indo.php"] [unique_id "aRoRcg3NjAS-v6ul5QB0DwAAAMw"]
[Mon Nov 17 02:01:22.713769 2025] [:error] [pid 55657:tid 55735] [client 74.176.64.167:41795] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fileas.php"] [unique_id "aRoRch2pywrNN427_XRPBgAAAdY"]
[Mon Nov 17 02:01:23.051800 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:41895] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fileas.php"] [unique_id "aRoRc6ZDObyEN97tsHBkbgAAAIs"]
[Mon Nov 17 02:01:23.369803 2025] [:error] [pid 55657:tid 55713] [client 74.176.64.167:41951] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fileas.php"] [unique_id "aRoRcx2pywrNN427_XRPCAAAAcU"]
[Mon Nov 17 02:01:23.727752 2025] [:error] [pid 65480:tid 321] [client 74.176.64.167:41863] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fileas.php"] [unique_id "aRoRcw3NjAS-v6ul5QB0EwAAAME"]
[Mon Nov 17 02:01:24.112302 2025] [:error] [pid 55657:tid 55730] [client 74.176.64.167:41902] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "aRoRdB2pywrNN427_XRPCgAAAdE"]
[Mon Nov 17 02:01:24.480363 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:41888] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "aRoRdA3NjAS-v6ul5QB0FQAAAM8"]
[Mon Nov 17 02:01:24.907561 2025] [:error] [pid 55656:tid 55704] [client 74.176.64.167:41924] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "aRoRdKZDObyEN97tsHBkbwAAAJA"]
[Mon Nov 17 02:01:25.169846 2025] [:error] [pid 55657:tid 55725] [client 74.176.64.167:41803] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "aRoRdR2pywrNN427_XRPDwAAAcw"]
[Mon Nov 17 02:01:25.633639 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:41917] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wfile.php"] [unique_id "aRoRdQ3NjAS-v6ul5QB0GQAAANE"]
[Mon Nov 17 02:01:25.950934 2025] [:error] [pid 55657:tid 55726] [client 74.176.64.167:41830] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wfile.php"] [unique_id "aRoRdR2pywrNN427_XRPEQAAAc0"]
[Mon Nov 17 02:01:26.194859 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:41825] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wfile.php"] [unique_id "aRoRdg3NjAS-v6ul5QB0GwAAAMY"]
[Mon Nov 17 02:01:26.441861 2025] [:error] [pid 55656:tid 55690] [client 74.176.64.167:41903] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wfile.php"] [unique_id "aRoRdqZDObyEN97tsHBkcQAAAIQ"]
[Mon Nov 17 02:01:26.713385 2025] [:error] [pid 55656:tid 55694] [client 74.176.64.167:41864] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "aRoRdqZDObyEN97tsHBkcgAAAIg"]
[Mon Nov 17 02:01:26.998318 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:41758] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "aRoRdg3NjAS-v6ul5QB0HQAAANU"]
[Mon Nov 17 02:01:27.304893 2025] [:error] [pid 55657:tid 55735] [client 74.176.64.167:41782] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "aRoRdx2pywrNN427_XRPEgAAAdY"]
[Mon Nov 17 02:01:27.547249 2025] [:error] [pid 55745:tid 55754] [client 74.176.64.167:41901] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "aRoRd4Zk0eT801XQsauJMQAAAEc"]
[Mon Nov 17 02:01:27.820381 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:41955] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aRoRdw3NjAS-v6ul5QB0HgAAANQ"]
[Mon Nov 17 02:01:28.113618 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:41908] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aRoReCGT_hu1vaVuRSR-qwAAAAw"]
[Mon Nov 17 02:01:28.359869 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41900] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aRoReCGT_hu1vaVuRSR-rAAAABQ"]
[Mon Nov 17 02:01:28.633923 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41960] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aRoReCGT_hu1vaVuRSR-rgAAAAE"]
[Mon Nov 17 02:01:28.904319 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:41792] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aRoReA3NjAS-v6ul5QB0IwAAANE"]
[Mon Nov 17 02:01:29.210796 2025] [:error] [pid 65480:tid 341] [client 74.176.64.167:41799] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aRoReQ3NjAS-v6ul5QB0JAAAANA"]
[Mon Nov 17 02:01:29.511419 2025] [:error] [pid 55745:tid 55768] [client 74.176.64.167:41943] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aRoReYZk0eT801XQsauJNQAAAFU"]
[Mon Nov 17 02:01:29.912297 2025] [:error] [pid 55745:tid 55756] [client 74.176.64.167:41802] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aRoReYZk0eT801XQsauJNgAAAEk"]
[Mon Nov 17 02:01:30.412972 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:41750] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usep.php"] [unique_id "aRoReoZk0eT801XQsauJPAAAAFE"]
[Mon Nov 17 02:01:30.863436 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:41849] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usep.php"] [unique_id "aRoReg3NjAS-v6ul5QB0PAAAAM0"]
[Mon Nov 17 02:01:31.242566 2025] [:error] [pid 55657:tid 55703] [client 74.176.64.167:41822] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usep.php"] [unique_id "aRoRex2pywrNN427_XRPIAAAAcA"]
[Mon Nov 17 02:01:31.550608 2025] [:error] [pid 55655:tid 55665] [client 74.176.64.167:41914] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usep.php"] [unique_id "aRoReyGT_hu1vaVuRSR-sgAAAAY"]
[Mon Nov 17 02:01:31.840933 2025] [:error] [pid 55745:tid 55765] [client 74.176.64.167:41875] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wa.php"] [unique_id "aRoRe4Zk0eT801XQsauJQwAAAFI"]
[Mon Nov 17 02:01:32.143730 2025] [:error] [pid 55655:tid 55682] [client 74.176.64.167:41906] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wa.php"] [unique_id "aRoRfCGT_hu1vaVuRSR-swAAABc"]
[Mon Nov 17 02:01:32.429616 2025] [:error] [pid 65480:tid 341] [client 74.176.64.167:41798] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wa.php"] [unique_id "aRoRfA3NjAS-v6ul5QB0QwAAANA"]
[Mon Nov 17 02:01:32.846163 2025] [:error] [pid 55655:tid 55676] [client 74.176.64.167:41880] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wa.php"] [unique_id "aRoRfCGT_hu1vaVuRSR-tgAAABE"]
[Mon Nov 17 02:01:33.196262 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:41963] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wb.php"] [unique_id "aRoRfQ3NjAS-v6ul5QB0RAAAAMg"]
[Mon Nov 17 02:01:33.491613 2025] [:error] [pid 55657:tid 55713] [client 74.176.64.167:41861] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wb.php"] [unique_id "aRoRfR2pywrNN427_XRPIQAAAcU"]
[Mon Nov 17 02:01:33.831146 2025] [:error] [pid 55657:tid 55734] [client 74.176.64.167:41956] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wb.php"] [unique_id "aRoRfR2pywrNN427_XRPIgAAAdU"]
[Mon Nov 17 02:01:34.098469 2025] [:error] [pid 55657:tid 55728] [client 74.176.64.167:41801] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wb.php"] [unique_id "aRoRfh2pywrNN427_XRPIwAAAc8"]
[Mon Nov 17 02:01:34.388147 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:41936] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "aRoRfg3NjAS-v6ul5QB0RgAAAMI"]
[Mon Nov 17 02:01:34.798339 2025] [:error] [pid 55745:tid 55755] [client 74.176.64.167:41850] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "aRoRfoZk0eT801XQsauJRAAAAEg"]
[Mon Nov 17 02:01:35.036285 2025] [:error] [pid 55655:tid 55664] [client 74.176.64.167:41868] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "aRoRfyGT_hu1vaVuRSR-uQAAAAU"]
[Mon Nov 17 02:01:35.329682 2025] [:error] [pid 55655:tid 55677] [client 74.176.64.167:41977] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "aRoRfyGT_hu1vaVuRSR-ugAAABI"]
[Mon Nov 17 02:01:35.677811 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:41909] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aRoRfyGT_hu1vaVuRSR-vQAAAAw"]
[Mon Nov 17 02:01:36.008999 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41915] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aRoRgCGT_hu1vaVuRSR-vgAAABQ"]
[Mon Nov 17 02:01:36.325290 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:41889] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aRoRgKZDObyEN97tsHBkjAAAAIs"]
[Mon Nov 17 02:01:36.629721 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:41913] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aRoRgA3NjAS-v6ul5QB0SAAAAM0"]
[Mon Nov 17 02:01:36.902690 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:41818] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/info.php"] [unique_id "aRoRgIZk0eT801XQsauJSQAAAEQ"]
[Mon Nov 17 02:01:37.282130 2025] [:error] [pid 55657:tid 55703] [client 74.176.64.167:41916] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/info.php"] [unique_id "aRoRgR2pywrNN427_XRPKAAAAcA"]
[Mon Nov 17 02:01:37.530187 2025] [:error] [pid 55745:tid 55766] [client 74.176.64.167:41732] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/info.php"] [unique_id "aRoRgYZk0eT801XQsauJSgAAAFM"]
[Mon Nov 17 02:01:37.822898 2025] [:error] [pid 55745:tid 55761] [client 74.176.64.167:41968] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/info.php"] [unique_id "aRoRgYZk0eT801XQsauJTAAAAE4"]
[Mon Nov 17 02:01:38.090938 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:41885] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file2.php"] [unique_id "aRoRgg3NjAS-v6ul5QB0SwAAANM"]
[Mon Nov 17 02:01:38.470216 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:41827] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file2.php"] [unique_id "aRoRgh2pywrNN427_XRPKQAAAcY"]
[Mon Nov 17 02:01:38.782685 2025] [:error] [pid 55655:tid 55669] [client 74.176.64.167:41979] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file2.php"] [unique_id "aRoRgiGT_hu1vaVuRSR-xAAAAAo"]
[Mon Nov 17 02:01:39.190680 2025] [:error] [pid 55656:tid 55687] [client 74.176.64.167:41749] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file2.php"] [unique_id "aRoRg6ZDObyEN97tsHBkkQAAAIE"]
[Mon Nov 17 02:01:39.458748 2025] [:error] [pid 55657:tid 55727] [client 74.176.64.167:41857] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoRgx2pywrNN427_XRPKgAAAc4"]
[Mon Nov 17 02:01:39.730338 2025] [:error] [pid 55655:tid 55659] [client 74.176.64.167:41731] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoRgyGT_hu1vaVuRSR-xgAAAAA"]
[Mon Nov 17 02:01:40.003889 2025] [:error] [pid 55657:tid 55713] [client 74.176.64.167:41981] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoRhB2pywrNN427_XRPKwAAAcU"]
[Mon Nov 17 02:01:40.246226 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:41954] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoRhCGT_hu1vaVuRSR-xwAAAAw"]
[Mon Nov 17 02:01:40.582946 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41961] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aRoRhCGT_hu1vaVuRSR-yAAAABQ"]
[Mon Nov 17 02:01:40.854403 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:41836] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aRoRhCGT_hu1vaVuRSR-yQAAAAQ"]
[Mon Nov 17 02:01:41.126135 2025] [:error] [pid 55745:tid 55759] [client 74.176.64.167:41935] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aRoRhYZk0eT801XQsauJUwAAAEw"]
[Mon Nov 17 02:01:41.379123 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:41841] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aRoRhQ3NjAS-v6ul5QB0UQAAAMo"]
[Mon Nov 17 02:01:41.626339 2025] [:error] [pid 55657:tid 55728] [client 74.176.64.167:41892] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aRoRhR2pywrNN427_XRPLQAAAc8"]
[Mon Nov 17 02:01:41.892046 2025] [:error] [pid 55656:tid 55704] [client 74.176.64.167:41759] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aRoRhaZDObyEN97tsHBklAAAAJA"]
[Mon Nov 17 02:01:42.151397 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:41807] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aRoRhh2pywrNN427_XRPLgAAAco"]
[Mon Nov 17 02:01:42.539922 2025] [:error] [pid 55657:tid 55712] [client 74.176.64.167:41886] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aRoRhh2pywrNN427_XRPLwAAAcQ"]
[Mon Nov 17 02:01:42.783929 2025] [:error] [pid 55657:tid 55717] [client 74.176.64.167:41840] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aRoRhh2pywrNN427_XRPMAAAAcc"]
[Mon Nov 17 02:01:43.076561 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:41796] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aRoRh6ZDObyEN97tsHBkmgAAAIw"]
[Mon Nov 17 02:01:43.334060 2025] [:error] [pid 55657:tid 55736] [client 74.176.64.167:41926] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aRoRhx2pywrNN427_XRPMQAAAdc"]
[Mon Nov 17 02:01:43.584208 2025] [:error] [pid 55656:tid 55699] [client 74.176.64.167:41819] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aRoRh6ZDObyEN97tsHBknQAAAI0"]
[Mon Nov 17 02:01:43.883529 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:41904] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pp.php"] [unique_id "aRoRhx2pywrNN427_XRPMgAAAdA"]
[Mon Nov 17 02:01:44.125810 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41813] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pp.php"] [unique_id "aRoRiCGT_hu1vaVuRSR-zQAAAAE"]
[Mon Nov 17 02:01:44.375883 2025] [:error] [pid 65480:tid 333] [client 74.176.64.167:41806] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pp.php"] [unique_id "aRoRiA3NjAS-v6ul5QB0WAAAAMs"]
[Mon Nov 17 02:01:44.622920 2025] [:error] [pid 55657:tid 55707] [client 74.176.64.167:41833] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pp.php"] [unique_id "aRoRiB2pywrNN427_XRPNAAAAcI"]
[Mon Nov 17 02:01:44.886861 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:41736] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geck.php"] [unique_id "aRoRiA3NjAS-v6ul5QB0WQAAANc"]
[Mon Nov 17 02:01:45.343246 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:41826] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geck.php"] [unique_id "aRoRiQ3NjAS-v6ul5QB0XQAAAMY"]
[Mon Nov 17 02:01:45.655839 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:41948] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geck.php"] [unique_id "aRoRiQ3NjAS-v6ul5QB0XgAAAMo"]
[Mon Nov 17 02:01:46.034225 2025] [:error] [pid 65480:tid 328] [client 74.176.64.167:41897] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geck.php"] [unique_id "aRoRig3NjAS-v6ul5QB0XwAAAMc"]
[Mon Nov 17 02:01:46.357429 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:41883] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gm.php"] [unique_id "aRoRig3NjAS-v6ul5QB0YgAAANM"]
[Mon Nov 17 02:01:46.714886 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:41730] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gm.php"] [unique_id "aRoRiqZDObyEN97tsHBknwAAAIs"]
[Mon Nov 17 02:01:46.987062 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:41928] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gm.php"] [unique_id "aRoRig3NjAS-v6ul5QB0ZQAAANE"]
[Mon Nov 17 02:01:47.340070 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:41739] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gm.php"] [unique_id "aRoRiw3NjAS-v6ul5QB0aQAAAMo"]
[Mon Nov 17 02:01:47.591264 2025] [:error] [pid 55657:tid 55713] [client 74.176.64.167:41809] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file4.php"] [unique_id "aRoRix2pywrNN427_XRPOgAAAcU"]
[Mon Nov 17 02:01:47.851056 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:41817] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file4.php"] [unique_id "aRoRiw3NjAS-v6ul5QB0cQAAANM"]
[Mon Nov 17 02:01:48.158573 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:41893] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file4.php"] [unique_id "aRoRjA3NjAS-v6ul5QB0dwAAANE"]
[Mon Nov 17 02:01:48.460902 2025] [:error] [pid 65480:tid 330] [client 74.176.64.167:41903] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file4.php"] [unique_id "aRoRjA3NjAS-v6ul5QB0fQAAAMk"]
[Mon Nov 17 02:01:48.862332 2025] [:error] [pid 55657:tid 55717] [client 74.176.64.167:41930] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/520.php"] [unique_id "aRoRjB2pywrNN427_XRPQQAAAcc"]
[Mon Nov 17 02:01:49.265719 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:41845] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/520.php"] [unique_id "aRoRjQ3NjAS-v6ul5QB0iwAAAMQ"]
[Mon Nov 17 02:01:49.521887 2025] [:error] [pid 55657:tid 55709] [client 74.176.64.167:41746] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/520.php"] [unique_id "aRoRjR2pywrNN427_XRPRwAAAcM"]
[Mon Nov 17 02:01:49.801622 2025] [:error] [pid 55656:tid 55687] [client 74.176.64.167:41835] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/520.php"] [unique_id "aRoRjaZDObyEN97tsHBktgAAAIE"]
[Mon Nov 17 02:01:50.208349 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:41754] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aRoRjqZDObyEN97tsHBkuAAAAIw"]
[Mon Nov 17 02:01:50.514336 2025] [:error] [pid 55656:tid 55702] [client 74.176.64.167:41737] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aRoRjqZDObyEN97tsHBkugAAAI8"]
[Mon Nov 17 02:01:50.764693 2025] [:error] [pid 55656:tid 55710] [client 74.176.64.167:41779] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aRoRjqZDObyEN97tsHBkuwAAAJM"]
[Mon Nov 17 02:01:51.090854 2025] [:error] [pid 55656:tid 55708] [client 74.176.64.167:41965] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aRoRj6ZDObyEN97tsHBkvQAAAJI"]
[Mon Nov 17 02:01:51.347445 2025] [:error] [pid 55655:tid 55662] [client 74.176.64.167:41911] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "aRoRjyGT_hu1vaVuRSR-0QAAAAM"]
[Mon Nov 17 02:01:51.705231 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:41735] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "aRoRjx2pywrNN427_XRPTgAAAcY"]
[Mon Nov 17 02:01:52.066416 2025] [:error] [pid 55655:tid 55665] [client 74.176.64.167:41823] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "aRoRkCGT_hu1vaVuRSR-0gAAAAY"]
[Mon Nov 17 02:01:52.354126 2025] [:error] [pid 55745:tid 55757] [client 74.176.64.167:41804] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "aRoRkIZk0eT801XQsauJYAAAAEo"]
[Mon Nov 17 02:01:52.628643 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:41762] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aRoRkA3NjAS-v6ul5QB0lQAAANE"]
[Mon Nov 17 02:01:52.937243 2025] [:error] [pid 65480:tid 328] [client 74.176.64.167:41834] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aRoRkA3NjAS-v6ul5QB0lgAAAMc"]
[Mon Nov 17 02:01:53.345564 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:41824] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aRoRkQ3NjAS-v6ul5QB0mgAAAMI"]
[Mon Nov 17 02:01:53.628475 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:41811] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aRoRkQ3NjAS-v6ul5QB0mwAAANY"]
[Mon Nov 17 02:01:53.878858 2025] [:error] [pid 55657:tid 55720] [client 74.176.64.167:41881] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "aRoRkR2pywrNN427_XRPUgAAAck"]
[Mon Nov 17 02:01:54.188977 2025] [:error] [pid 55745:tid 55768] [client 74.176.64.167:41893] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "aRoRkoZk0eT801XQsauJYwAAAFU"]
[Mon Nov 17 02:01:54.535952 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41831] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "aRoRkiGT_hu1vaVuRSR-2AAAAAE"]
[Mon Nov 17 02:01:54.846686 2025] [:error] [pid 55656:tid 55695] [client 74.176.64.167:41814] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "aRoRkqZDObyEN97tsHBkxgAAAIk"]
[Mon Nov 17 02:03:46.906991 2025] [:error] [pid 55745:tid 55755] [client 74.176.64.167:41794] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-freya.php"] [unique_id "aRoSAoZk0eT801XQsauKWgAAAEg"]
[Mon Nov 17 02:03:47.184155 2025] [:error] [pid 55745:tid 55747] [client 74.176.64.167:41777] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-freya.php"] [unique_id "aRoSA4Zk0eT801XQsauKXAAAAEA"]
[Mon Nov 17 02:03:47.437953 2025] [:error] [pid 65480:tid 330] [client 74.176.64.167:41894] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-freya.php"] [unique_id "aRoSAw3NjAS-v6ul5QB2AgAAAMk"]
[Mon Nov 17 02:03:47.727179 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:41896] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-freya.php"] [unique_id "aRoSA4Zk0eT801XQsauKXQAAAEQ"]
[Mon Nov 17 02:03:47.982247 2025] [:error] [pid 55657:tid 55736] [client 74.176.64.167:41742] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/X7x.php"] [unique_id "aRoSAx2pywrNN427_XRQCgAAAdc"]
[Mon Nov 17 02:03:48.316671 2025] [:error] [pid 55656:tid 55702] [client 74.176.64.167:41768] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/X7x.php"] [unique_id "aRoSBKZDObyEN97tsHBlWwAAAI8"]
[Mon Nov 17 02:03:48.662025 2025] [:error] [pid 55657:tid 55705] [client 74.176.64.167:41854] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/X7x.php"] [unique_id "aRoSBB2pywrNN427_XRQCwAAAcE"]
[Mon Nov 17 02:03:48.935160 2025] [:error] [pid 65480:tid 320] [client 74.176.64.167:41751] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/X7x.php"] [unique_id "aRoSBA3NjAS-v6ul5QB2BQAAAMA"]
[Mon Nov 17 02:03:49.314884 2025] [:error] [pid 65480:tid 321] [client 74.176.64.167:41847] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admir.php"] [unique_id "aRoSBQ3NjAS-v6ul5QB2BwAAAME"]
[Mon Nov 17 02:03:49.565086 2025] [:error] [pid 65480:tid 350] [client 74.176.64.167:41767] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admir.php"] [unique_id "aRoSBQ3NjAS-v6ul5QB2CQAAANg"]
[Mon Nov 17 02:03:49.885094 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:41832] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admir.php"] [unique_id "aRoSBR2pywrNN427_XRQDAAAAco"]
[Mon Nov 17 02:03:50.204101 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:41885] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admir.php"] [unique_id "aRoSBoZk0eT801XQsauKXwAAAFE"]
[Mon Nov 17 02:03:50.468672 2025] [:error] [pid 55655:tid 55677] [client 74.176.64.167:41771] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file52.php"] [unique_id "aRoSBiGT_hu1vaVuRSR_wAAAABI"]
[Mon Nov 17 02:03:50.735413 2025] [:error] [pid 55655:tid 55665] [client 74.176.64.167:41741] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file52.php"] [unique_id "aRoSBiGT_hu1vaVuRSR_wgAAAAY"]
[Mon Nov 17 02:03:51.015755 2025] [:error] [pid 55656:tid 55688] [client 74.176.64.167:41890] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file52.php"] [unique_id "aRoSB6ZDObyEN97tsHBlXQAAAII"]
[Mon Nov 17 02:03:51.351988 2025] [:error] [pid 55656:tid 55710] [client 74.176.64.167:41846] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file52.php"] [unique_id "aRoSB6ZDObyEN97tsHBlXwAAAJM"]
[Mon Nov 17 02:03:51.740545 2025] [:error] [pid 65480:tid 320] [client 74.176.64.167:41862] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zde.php"] [unique_id "aRoSBw3NjAS-v6ul5QB2EAAAAMA"]
[Mon Nov 17 02:03:51.996990 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:41882] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zde.php"] [unique_id "aRoSByGT_hu1vaVuRSR_xAAAAAc"]
[Mon Nov 17 02:03:52.345823 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:41952] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zde.php"] [unique_id "aRoSCA3NjAS-v6ul5QB2FQAAAM0"]
[Mon Nov 17 02:03:52.612172 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:41781] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zde.php"] [unique_id "aRoSCB2pywrNN427_XRQEQAAAcY"]
[Mon Nov 17 02:03:52.905249 2025] [:error] [pid 65480:tid 350] [client 74.176.64.167:41668] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "aRoSCA3NjAS-v6ul5QB2FwAAANg"]
[Mon Nov 17 02:03:53.160208 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:41755] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "aRoSCQ3NjAS-v6ul5QB2GQAAAMM"]
[Mon Nov 17 02:03:53.426751 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:41828] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "aRoSCQ3NjAS-v6ul5QB2GwAAAMQ"]
[Mon Nov 17 02:03:53.687479 2025] [:error] [pid 55745:tid 55762] [client 74.176.64.167:41694] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "aRoSCYZk0eT801XQsauKYwAAAE8"]
[Mon Nov 17 02:03:53.946841 2025] [:error] [pid 55656:tid 55693] [client 74.176.64.167:41843] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aj.php"] [unique_id "aRoSCaZDObyEN97tsHBlbQAAAIc"]
[Mon Nov 17 02:03:54.187827 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:41676] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aj.php"] [unique_id "aRoSCoZk0eT801XQsauKZAAAAFE"]
[Mon Nov 17 02:03:54.543779 2025] [:error] [pid 55745:tid 55749] [client 74.176.64.167:41855] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aj.php"] [unique_id "aRoSCoZk0eT801XQsauKZgAAAEI"]
[Mon Nov 17 02:03:54.921857 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:41842] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aj.php"] [unique_id "aRoSCg3NjAS-v6ul5QB2HgAAANQ"]
[Mon Nov 17 02:03:55.239048 2025] [:error] [pid 55655:tid 55670] [client 74.176.64.167:41675] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/opts.php"] [unique_id "aRoSCyGT_hu1vaVuRSR_xgAAAAs"]
[Mon Nov 17 02:03:55.522114 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:41816] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/opts.php"] [unique_id "aRoSCyGT_hu1vaVuRSR_yAAAABM"]
[Mon Nov 17 02:03:55.799562 2025] [:error] [pid 55655:tid 55661] [client 74.176.64.167:41765] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/opts.php"] [unique_id "aRoSCyGT_hu1vaVuRSR_yQAAAAI"]
[Mon Nov 17 02:03:56.145163 2025] [:error] [pid 55655:tid 55682] [client 74.176.64.167:41640] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/opts.php"] [unique_id "aRoSDCGT_hu1vaVuRSR_ywAAABc"]
[Mon Nov 17 02:03:56.431415 2025] [:error] [pid 55745:tid 55757] [client 74.176.64.167:41773] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filer.php"] [unique_id "aRoSDIZk0eT801XQsauKagAAAEo"]
[Mon Nov 17 02:03:56.716522 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:41810] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filer.php"] [unique_id "aRoSDCGT_hu1vaVuRSR_zgAAAAw"]
[Mon Nov 17 02:03:56.972570 2025] [:error] [pid 55745:tid 55750] [client 74.176.64.167:41838] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filer.php"] [unique_id "aRoSDIZk0eT801XQsauKawAAAEM"]
[Mon Nov 17 02:03:57.473929 2025] [:error] [pid 55657:tid 55733] [client 74.176.64.167:41665] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filer.php"] [unique_id "aRoSDR2pywrNN427_XRQGAAAAdQ"]
[Mon Nov 17 02:03:57.810954 2025] [:error] [pid 55655:tid 55662] [client 74.176.64.167:41774] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "aRoSDSGT_hu1vaVuRSR_0AAAAAM"]
[Mon Nov 17 02:03:58.159804 2025] [:error] [pid 65480:tid 330] [client 74.176.64.167:41763] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "aRoSDg3NjAS-v6ul5QB2IwAAAMk"]
[Mon Nov 17 02:03:58.585205 2025] [:error] [pid 55656:tid 55699] [client 74.176.64.167:41761] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "aRoSDqZDObyEN97tsHBldQAAAI0"]
[Mon Nov 17 02:03:58.914058 2025] [:error] [pid 55656:tid 55702] [client 74.176.64.167:41753] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "aRoSDqZDObyEN97tsHBldgAAAI8"]
[Mon Nov 17 02:03:59.311823 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:41679] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aRoSDw3NjAS-v6ul5QB2JgAAAM0"]
[Mon Nov 17 02:03:59.606268 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:41682] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aRoSDw3NjAS-v6ul5QB2JwAAAM8"]
[Mon Nov 17 02:04:00.063149 2025] [:error] [pid 55745:tid 55748] [client 74.176.64.167:41740] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aRoSEIZk0eT801XQsauKbQAAAEE"]
[Mon Nov 17 02:04:00.593889 2025] [:error] [pid 65480:tid 321] [client 74.176.64.167:41718] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aRoSEA3NjAS-v6ul5QB2KAAAAME"]
[Mon Nov 17 02:04:00.984813 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:41669] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "aRoSEIZk0eT801XQsauKbwAAAFc"]
[Mon Nov 17 02:04:01.394464 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:41681] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "aRoSESGT_hu1vaVuRSR_1QAAAAk"]
[Mon Nov 17 02:04:01.690230 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:41898] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "aRoSEQ3NjAS-v6ul5QB2LQAAAMY"]
[Mon Nov 17 02:04:02.025029 2025] [:error] [pid 65480:tid 325] [client 74.176.64.167:41600] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "aRoSEg3NjAS-v6ul5QB2MAAAAMU"]
[Mon Nov 17 02:04:02.374678 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:41842] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aRoSEg3NjAS-v6ul5QB2MgAAAM0"]
[Mon Nov 17 02:04:02.688448 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:41608] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aRoSEg3NjAS-v6ul5QB2NQAAAM8"]
[Mon Nov 17 02:04:03.246368 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:41844] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aRoSEw3NjAS-v6ul5QB2OAAAAMQ"]
[Mon Nov 17 02:04:03.802993 2025] [:error] [pid 55655:tid 55662] [client 74.176.64.167:41689] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aRoSEyGT_hu1vaVuRSR_2gAAAAM"]
[Mon Nov 17 02:04:04.279957 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:41691] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aRoSFA3NjAS-v6ul5QB2PQAAAMY"]
[Mon Nov 17 02:04:04.541741 2025] [:error] [pid 55745:tid 55747] [client 74.176.64.167:41978] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aRoSFIZk0eT801XQsauKdQAAAEA"]
[Mon Nov 17 02:04:04.817817 2025] [:error] [pid 55745:tid 55755] [client 74.176.64.167:41939] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aRoSFIZk0eT801XQsauKdgAAAEg"]
[Mon Nov 17 02:04:05.082299 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:41851] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aRoSFQ3NjAS-v6ul5QB2PgAAANQ"]
[Mon Nov 17 02:04:05.423261 2025] [:error] [pid 55655:tid 55670] [client 74.176.64.167:41745] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "aRoSFSGT_hu1vaVuRSR_3gAAAAs"]
[Mon Nov 17 02:04:05.698191 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41683] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "aRoSFSGT_hu1vaVuRSR_4QAAABQ"]
[Mon Nov 17 02:04:06.016394 2025] [:error] [pid 55655:tid 55682] [client 74.176.64.167:41770] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "aRoSFiGT_hu1vaVuRSR_4wAAABc"]
[Mon Nov 17 02:04:06.353053 2025] [:error] [pid 55745:tid 55769] [client 74.176.64.167:41887] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "aRoSFoZk0eT801XQsauKegAAAFY"]
[Mon Nov 17 02:04:06.683438 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:41692] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "aRoSFiGT_hu1vaVuRSR_5QAAABM"]
[Mon Nov 17 02:04:06.938892 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:41852] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "aRoSFoZk0eT801XQsauKfgAAAFE"]
[Mon Nov 17 02:04:07.200787 2025] [:error] [pid 55745:tid 55754] [client 74.176.64.167:41674] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "aRoSF4Zk0eT801XQsauKfwAAAEc"]
[Mon Nov 17 02:04:07.446819 2025] [:error] [pid 55745:tid 55758] [client 74.176.64.167:41673] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "aRoSF4Zk0eT801XQsauKgQAAAEs"]
[Mon Nov 17 02:04:07.760904 2025] [:error] [pid 55745:tid 55752] [client 74.176.64.167:41766] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRoSF4Zk0eT801XQsauKgwAAAEU"]
[Mon Nov 17 02:04:08.237151 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:41666] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRoSGCGT_hu1vaVuRSR_6gAAAAQ"]
[Mon Nov 17 02:04:08.519956 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:41769] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRoSGCGT_hu1vaVuRSR_6wAAAAc"]
[Mon Nov 17 02:04:08.767834 2025] [:error] [pid 55745:tid 55749] [client 74.176.64.167:41784] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRoSGIZk0eT801XQsauKhgAAAEI"]
[Mon Nov 17 02:04:09.014842 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:41703] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gorila.php"] [unique_id "aRoSGQ3NjAS-v6ul5QB2QgAAANc"]
[Mon Nov 17 02:04:09.322421 2025] [:error] [pid 55657:tid 55727] [client 74.176.64.167:41738] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gorila.php"] [unique_id "aRoSGR2pywrNN427_XRQHwAAAc4"]
[Mon Nov 17 02:04:09.580352 2025] [:error] [pid 55656:tid 55691] [client 74.176.64.167:41724] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gorila.php"] [unique_id "aRoSGaZDObyEN97tsHBligAAAIU"]
[Mon Nov 17 02:04:09.931164 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41790] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gorila.php"] [unique_id "aRoSGSGT_hu1vaVuRSR_7QAAAAE"]
[Mon Nov 17 02:04:10.283613 2025] [:error] [pid 55655:tid 55675] [client 74.176.64.167:41709] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanta.php"] [unique_id "aRoSGiGT_hu1vaVuRSR_8AAAABA"]
[Mon Nov 17 02:04:10.562407 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:41690] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanta.php"] [unique_id "aRoSGh2pywrNN427_XRQIAAAAcY"]
[Mon Nov 17 02:04:10.867939 2025] [:error] [pid 55745:tid 55755] [client 74.176.64.167:41776] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanta.php"] [unique_id "aRoSGoZk0eT801XQsauKigAAAEg"]
[Mon Nov 17 02:04:11.143632 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:41780] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanta.php"] [unique_id "aRoSGx2pywrNN427_XRQIwAAAco"]
[Mon Nov 17 02:04:11.403637 2025] [:error] [pid 55656:tid 55694] [client 74.176.64.167:41705] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh3ll.php"] [unique_id "aRoSG6ZDObyEN97tsHBljgAAAIg"]
[Mon Nov 17 02:04:11.660251 2025] [:error] [pid 55657:tid 55732] [client 74.176.64.167:41716] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh3ll.php"] [unique_id "aRoSGx2pywrNN427_XRQJAAAAdM"]
[Mon Nov 17 02:04:11.903732 2025] [:error] [pid 55655:tid 55664] [client 74.176.64.167:41789] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh3ll.php"] [unique_id "aRoSGyGT_hu1vaVuRSR_9AAAAAU"]
[Mon Nov 17 02:04:12.157282 2025] [:error] [pid 65480:tid 350] [client 74.176.64.167:41785] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh3ll.php"] [unique_id "aRoSHA3NjAS-v6ul5QB2RAAAANg"]
[Mon Nov 17 02:04:12.452097 2025] [:error] [pid 55657:tid 55734] [client 74.176.64.167:41786] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "aRoSHB2pywrNN427_XRQKQAAAdU"]
[Mon Nov 17 02:04:12.717796 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:41793] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "aRoSHA3NjAS-v6ul5QB2RwAAAMQ"]
[Mon Nov 17 02:04:12.972839 2025] [:error] [pid 65480:tid 333] [client 74.176.64.167:41688] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "aRoSHA3NjAS-v6ul5QB2SAAAAMs"]
[Mon Nov 17 02:04:13.288771 2025] [:error] [pid 65480:tid 335] [client 74.176.64.167:41664] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "aRoSHQ3NjAS-v6ul5QB2SQAAAMw"]
[Mon Nov 17 02:04:13.567416 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:41687] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filesss.php"] [unique_id "aRoSHQ3NjAS-v6ul5QB2TAAAANU"]
[Mon Nov 17 02:04:13.833799 2025] [:error] [pid 55657:tid 55733] [client 74.176.64.167:41748] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filesss.php"] [unique_id "aRoSHR2pywrNN427_XRQLgAAAdQ"]
[Mon Nov 17 02:04:14.112450 2025] [:error] [pid 55745:tid 55760] [client 74.176.64.167:41752] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filesss.php"] [unique_id "aRoSHoZk0eT801XQsauKkQAAAE0"]
[Mon Nov 17 02:04:14.378970 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:41704] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/filesss.php"] [unique_id "aRoSHg3NjAS-v6ul5QB2TgAAAMY"]
[Mon Nov 17 02:04:14.642183 2025] [:error] [pid 65480:tid 321] [client 74.176.64.167:41743] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-aaa.php"] [unique_id "aRoSHg3NjAS-v6ul5QB2TwAAAME"]
[Mon Nov 17 02:04:14.964597 2025] [:error] [pid 65480:tid 338] [client 74.176.64.167:41695] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-aaa.php"] [unique_id "aRoSHg3NjAS-v6ul5QB2UAAAAM4"]
[Mon Nov 17 02:04:15.262134 2025] [:error] [pid 55745:tid 55750] [client 74.176.64.167:41756] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-aaa.php"] [unique_id "aRoSH4Zk0eT801XQsauKlAAAAEM"]
[Mon Nov 17 02:04:15.599744 2025] [:error] [pid 55745:tid 55771] [client 74.176.64.167:41706] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-aaa.php"] [unique_id "aRoSH4Zk0eT801XQsauKlQAAAFg"]
[Mon Nov 17 02:04:15.915131 2025] [:error] [pid 55655:tid 55669] [client 74.176.64.167:41910] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aRoSHyGT_hu1vaVuRSR_-wAAAAo"]
[Mon Nov 17 02:04:16.241713 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:41757] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aRoSIA3NjAS-v6ul5QB2VAAAAMg"]
[Mon Nov 17 02:04:16.513249 2025] [:error] [pid 55745:tid 55767] [client 74.176.64.167:41697] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aRoSIIZk0eT801XQsauKlgAAAFQ"]
[Mon Nov 17 02:04:16.829042 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:41791] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aRoSIB2pywrNN427_XRQMgAAAdA"]
[Mon Nov 17 02:04:17.159656 2025] [:error] [pid 55745:tid 55748] [client 74.176.64.167:41619] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aRoSIYZk0eT801XQsauKmQAAAEE"]
[Mon Nov 17 02:04:17.525132 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:41604] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aRoSIQ3NjAS-v6ul5QB2VQAAANU"]
[Mon Nov 17 02:04:17.897681 2025] [:error] [pid 55745:tid 55754] [client 74.176.64.167:41602] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aRoSIYZk0eT801XQsauKmgAAAEc"]
[Mon Nov 17 02:04:18.187946 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:41618] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aRoSIg3NjAS-v6ul5QB2WgAAANM"]
[Mon Nov 17 02:04:18.476038 2025] [:error] [pid 55745:tid 55765] [client 74.176.64.167:41686] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "aRoSIoZk0eT801XQsauKmwAAAFI"]
[Mon Nov 17 02:04:18.763603 2025] [:error] [pid 55657:tid 55724] [client 74.176.64.167:41702] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "aRoSIh2pywrNN427_XRQNAAAAcs"]
[Mon Nov 17 02:04:19.160700 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:41616] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "aRoSIw3NjAS-v6ul5QB2XQAAANY"]
[Mon Nov 17 02:04:19.476992 2025] [:error] [pid 65480:tid 325] [client 74.176.64.167:41734] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "aRoSIw3NjAS-v6ul5QB2XwAAAMU"]
[Mon Nov 17 02:04:19.749739 2025] [:error] [pid 65480:tid 343] [client 74.176.64.167:41788] [client 74.176.64.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aRoSIw3NjAS-v6ul5QB2YAAAANI"]
[Mon Nov 17 02:04:20.034523 2025] [:error] [pid 65480:tid 338] [client 74.176.64.167:41610] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aRoSJA3NjAS-v6ul5QB2YQAAAM4"]
[Mon Nov 17 02:04:20.299754 2025] [:error] [pid 55745:tid 55760] [client 74.176.64.167:41284] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aRoSJIZk0eT801XQsauKnwAAAE0"]
[Mon Nov 17 02:04:20.639226 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:41617] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aRoSJKZDObyEN97tsHBlpAAAAIw"]
[Mon Nov 17 02:04:20.978971 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:41848] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aRoSJCGT_hu1vaVuRSSABgAAABM"]
[Mon Nov 17 02:04:21.257808 2025] [:error] [pid 65480:tid 350] [client 74.176.64.167:41693] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aRoSJQ3NjAS-v6ul5QB2YgAAANg"]
[Mon Nov 17 02:04:21.567019 2025] [:error] [pid 55655:tid 55662] [client 74.176.64.167:41783] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aRoSJSGT_hu1vaVuRSSABwAAAAM"]
[Mon Nov 17 02:04:21.924774 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:41714] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aRoSJR2pywrNN427_XRQNwAAAcg"]
[Mon Nov 17 02:04:22.220921 2025] [:error] [pid 65480:tid 335] [client 74.176.64.167:41641] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aRoSJg3NjAS-v6ul5QB2ZQAAAMw"]
[Mon Nov 17 02:04:22.492822 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:41652] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoSJiGT_hu1vaVuRSSACAAAAAQ"]
[Mon Nov 17 02:04:22.806082 2025] [:error] [pid 55657:tid 55726] [client 74.176.64.167:41744] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoSJh2pywrNN427_XRQOAAAAc0"]
[Mon Nov 17 02:04:23.062691 2025] [:error] [pid 55656:tid 55708] [client 74.176.64.167:41719] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoSJ6ZDObyEN97tsHBlqgAAAJI"]
[Mon Nov 17 02:04:23.386949 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:41611] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "aRoSJyGT_hu1vaVuRSSADQAAAAE"]
[Mon Nov 17 02:04:24.084841 2025] [:error] [pid 55745:tid 55767] [client 74.176.64.167:41708] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file.php"] [unique_id "aRoSKIZk0eT801XQsauKowAAAFQ"]
[Mon Nov 17 02:04:24.823291 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:41680] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file.php"] [unique_id "aRoSKB2pywrNN427_XRQPAAAAdA"]
[Mon Nov 17 02:04:25.241519 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:41667] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file.php"] [unique_id "aRoSKYZk0eT801XQsauKpAAAAEQ"]
[Mon Nov 17 02:04:25.584706 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:41314] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file.php"] [unique_id "aRoSKQ3NjAS-v6ul5QB2aQAAANQ"]
[Mon Nov 17 02:04:26.617015 2025] [:error] [pid 65480:tid 320] [client 74.176.64.167:41815] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/la.php"] [unique_id "aRoSKg3NjAS-v6ul5QB2bQAAAMA"]
[Mon Nov 17 02:04:27.557500 2025] [:error] [pid 55656:tid 55696] [client 74.176.64.167:41942] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/la.php"] [unique_id "aRoSK6ZDObyEN97tsHBlrwAAAIo"]
[Mon Nov 17 02:04:28.463975 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:41922] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/la.php"] [unique_id "aRoSLA3NjAS-v6ul5QB2dAAAAMQ"]
[Mon Nov 17 02:04:28.797130 2025] [:error] [pid 55656:tid 55711] [client 74.176.64.167:41787] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/la.php"] [unique_id "aRoSLKZDObyEN97tsHBlsAAAAJQ"]
[Mon Nov 17 02:04:29.246787 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:41659] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abc.php"] [unique_id "aRoSLQ3NjAS-v6ul5QB2dgAAANY"]
[Mon Nov 17 02:04:29.862183 2025] [:error] [pid 65480:tid 343] [client 74.176.64.167:41711] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abc.php"] [unique_id "aRoSLQ3NjAS-v6ul5QB2eAAAANI"]
[Mon Nov 17 02:04:30.300098 2025] [:error] [pid 55745:tid 55752] [client 74.176.64.167:41678] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abc.php"] [unique_id "aRoSLoZk0eT801XQsauKpwAAAEU"]
[Mon Nov 17 02:04:30.628501 2025] [:error] [pid 55657:tid 55724] [client 74.176.64.167:41722] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abc.php"] [unique_id "aRoSLh2pywrNN427_XRQQwAAAcs"]
[Mon Nov 17 02:04:31.238603 2025] [:error] [pid 55656:tid 55693] [client 74.176.64.167:41778] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berlin.php"] [unique_id "aRoSL6ZDObyEN97tsHBltAAAAIc"]
[Mon Nov 17 02:04:31.797010 2025] [:error] [pid 55745:tid 55761] [client 74.176.64.167:41553] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berlin.php"] [unique_id "aRoSL4Zk0eT801XQsauKqwAAAE4"]
[Mon Nov 17 02:04:32.314426 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:41625] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berlin.php"] [unique_id "aRoSMA3NjAS-v6ul5QB2fAAAAM8"]
[Mon Nov 17 02:04:32.595495 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:41729] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berlin.php"] [unique_id "aRoSMCGT_hu1vaVuRSSAEAAAAAk"]
[Mon Nov 17 02:04:32.884192 2025] [:error] [pid 55657:tid 55705] [client 74.176.64.167:41715] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/avaa.php"] [unique_id "aRoSMB2pywrNN427_XRQRAAAAcE"]
[Mon Nov 17 02:04:33.337836 2025] [:error] [pid 55657:tid 55726] [client 74.176.64.167:41548] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/avaa.php"] [unique_id "aRoSMR2pywrNN427_XRQRQAAAc0"]
[Mon Nov 17 02:04:33.632376 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:41764] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/avaa.php"] [unique_id "aRoSMR2pywrNN427_XRQRgAAAdA"]
[Mon Nov 17 02:04:34.089859 2025] [:error] [pid 55656:tid 55699] [client 74.176.64.167:41658] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/avaa.php"] [unique_id "aRoSMqZDObyEN97tsHBltwAAAI0"]
[Mon Nov 17 02:04:34.484670 2025] [:error] [pid 55656:tid 55694] [client 74.176.64.167:41604] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aRoSMqZDObyEN97tsHBluAAAAIg"]
[Mon Nov 17 02:04:34.825714 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:41707] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aRoSMqZDObyEN97tsHBluQAAAIw"]
[Mon Nov 17 02:04:35.173728 2025] [:error] [pid 55657:tid 55720] [client 74.176.64.167:41310] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aRoSMx2pywrNN427_XRQTQAAAck"]
[Mon Nov 17 02:04:35.530605 2025] [:error] [pid 55657:tid 55731] [client 74.176.64.167:41285] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aRoSMx2pywrNN427_XRQTgAAAdI"]
[Mon Nov 17 02:04:35.822888 2025] [:error] [pid 55745:tid 55762] [client 74.176.64.167:41615] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goat1.php"] [unique_id "aRoSM4Zk0eT801XQsauKswAAAE8"]
[Mon Nov 17 02:04:36.100338 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:41634] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goat1.php"] [unique_id "aRoSNA3NjAS-v6ul5QB2fwAAAMo"]
[Mon Nov 17 02:04:36.381083 2025] [:error] [pid 55745:tid 55750] [client 74.176.64.167:41288] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goat1.php"] [unique_id "aRoSNIZk0eT801XQsauKtQAAAEM"]
[Mon Nov 17 02:04:36.656307 2025] [:error] [pid 55657:tid 55736] [client 74.176.64.167:41964] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goat1.php"] [unique_id "aRoSNB2pywrNN427_XRQUAAAAdc"]
[Mon Nov 17 02:04:36.974912 2025] [:error] [pid 55745:tid 55767] [client 74.176.64.167:41760] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "aRoSNIZk0eT801XQsauKtwAAAFQ"]
[Mon Nov 17 02:04:37.313663 2025] [:error] [pid 55745:tid 55768] [client 74.176.64.167:41721] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "aRoSNYZk0eT801XQsauKuQAAAFU"]
[Mon Nov 17 02:04:37.694103 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:41684] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "aRoSNSGT_hu1vaVuRSSAFAAAABQ"]
[Mon Nov 17 02:04:38.081112 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:41624] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "aRoSNh2pywrNN427_XRQVAAAAdA"]
[Mon Nov 17 02:04:38.392637 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:41620] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aRoSNh2pywrNN427_XRQVgAAAco"]
[Mon Nov 17 02:04:38.628477 2025] [:error] [pid 55657:tid 55709] [client 74.176.64.167:41601] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aRoSNh2pywrNN427_XRQVwAAAcM"]
[Mon Nov 17 02:04:38.927635 2025] [:error] [pid 55657:tid 55725] [client 74.176.64.167:41663] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aRoSNh2pywrNN427_XRQWAAAAcw"]
[Mon Nov 17 13:05:04.991541 2025] [:error] [pid 39449:tid 39458] [client 203.2.64.59:39931] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRqtAKUCymTA3MDfzLMNCQAAAAQ"]
[Mon Nov 17 16:04:42.140588 2025] [:error] [pid 20913:tid 20933] [client 91.224.90.83:52230] [client 91.224.90.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.90.83, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRrXGukafGNeN3nY1bcvNwAAA1I"], referer: http://paramountestate.com
[Mon Nov 17 16:11:44.256263 2025] [:error] [pid 15888:tid 15893] [client 70.40.255.4:59004] [client 70.40.255.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.40.255.4, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRrYwAjAdDTBm4W3qW0WSAAAAcI"], referer: http://paramountestate.com
[Mon Nov 17 16:19:21.169994 2025] [:error] [pid 65302:tid 65323] [client 132.145.155.93:52038] [client 132.145.155.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.145.155.93, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRraiQPMSx2v85r8y7ze9wAAAVM"], referer: http://paramountestate.com
[Mon Nov 17 16:24:43.690400 2025] [:error] [pid 15888:tid 15911] [client 67.23.254.96:41770] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.23.254.96, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRrbywjAdDTBm4W3qW0X9AAAAdQ"]
[Mon Nov 17 16:34:55.671740 2025] [:error] [pid 39537:tid 39546] [client 81.177.135.2:52678] [client 81.177.135.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.177.135.2, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRreL4ZRrh1pcrdcLB-cngAAAMY"], referer: http://paramountestate.com
[Mon Nov 17 16:43:20.322899 2025] [:error] [pid 30801:tid 30813] [client 134.209.118.102:38516] [client 134.209.118.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.118.102, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRrgKDbGAU49DhMTBD7QOAAAAko"], referer: http://paramountestate.com
[Mon Nov 17 16:51:58.984626 2025] [:error] [pid 65302:tid 65322] [client 104.207.254.70:55385] [client 104.207.254.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.207.254.70, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRriLgPMSx2v85r8y7zi-AAAAVI"], referer: http://paramountestate.com
[Mon Nov 17 16:59:26.159779 2025] [:error] [pid 39449:tid 39454] [client 170.106.11.141:58926] [client 170.106.11.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRrj7qUCymTA3MDfzLMuqQAAAAA"]
[Mon Nov 17 17:09:17.366583 2025] [:error] [pid 32753:tid 32777] [client 47.238.97.17:46130] [client 47.238.97.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.238.97.17, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRrmPU6YNqI5vkht921MqwAAA9U"], referer: http://paramountestate.com
[Mon Nov 17 17:18:16.746928 2025] [:error] [pid 32753:tid 32774] [client 213.136.93.169:42460] [client 213.136.93.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.136.93.169, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRroWE6YNqI5vkht921PDAAAA9I"], referer: http://paramountestate.com
[Mon Nov 17 17:26:44.280645 2025] [:error] [pid 65302:tid 65328] [client 64.227.167.65:44230] [client 64.227.167.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.227.167.65, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRrqVAPMSx2v85r8y7zoIwAAAVg"], referer: http://paramountestate.com
[Mon Nov 17 17:43:39.705236 2025] [:error] [pid 65302:tid 65314] [client 81.88.53.97:47762] [client 81.88.53.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.53.97, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRruSwPMSx2v85r8y7zrHwAAAUo"], referer: http://paramountestate.com
[Mon Nov 17 18:00:44.258051 2025] [:error] [pid 39537:tid 39556] [client 101.37.75.104:44816] [client 101.37.75.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.37.75.104, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRryTIZRrh1pcrdcLB-pfAAAANA"], referer: http://paramountestate.com
[Mon Nov 17 18:09:08.838088 2025] [:error] [pid 40548:tid 40573] [client 195.154.194.72:16312] [client 195.154.194.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.154.194.72, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr0RAM_PykfYnxh-j9atQAAARc"], referer: http://paramountestate.com
[Mon Nov 17 18:18:04.441380 2025] [:error] [pid 39451:tid 39510] [client 123.31.12.39:33970] [client 123.31.12.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.31.12.39, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr2XOfgkqXTS0SO3fATRwAAAII"], referer: http://paramountestate.com
[Mon Nov 17 18:23:17.935149 2025] [:error] [pid 20913:tid 20923] [client 164.100.214.27:32286] [client 164.100.214.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.100.214.27, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr3lekafGNeN3nY1bdIHwAAA0g"]
[Mon Nov 17 18:26:37.230247 2025] [:error] [pid 40548:tid 40553] [client 162.240.6.87:38760] [client 162.240.6.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.240.6.87, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr4XQM_PykfYnxh-j9d8wAAAQM"], referer: http://paramountestate.com
[Mon Nov 17 18:35:12.167652 2025] [:error] [pid 20913:tid 20937] [client 52.221.97.93:40806] [client 52.221.97.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.221.97.93, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr6YOkafGNeN3nY1bdKOwAAA1Y"], referer: http://paramountestate.com
[Mon Nov 17 18:43:53.640209 2025] [:error] [pid 32753:tid 32772] [client 103.218.122.203:54610] [client 103.218.122.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.218.122.203, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr8aU6YNqI5vkht921q8gAAA9A"], referer: http://paramountestate.com
[Mon Nov 17 18:52:29.338751 2025] [:error] [pid 39451:tid 39517] [client 157.230.20.249:45344] [client 157.230.20.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.20.249, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRr-befgkqXTS0SO3fAYeQAAAIk"], referer: http://paramountestate.com
[Mon Nov 17 19:10:15.469130 2025] [:error] [pid 39449:tid 39464] [client 103.218.122.203:48550] [client 103.218.122.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.218.122.203, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsCl6UCymTA3MDfzLNPRwAAAAo"], referer: http://paramountestate.com
[Mon Nov 17 19:18:54.380232 2025] [:error] [pid 20913:tid 20916] [client 51.79.250.168:59714] [client 51.79.250.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.250.168, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsEnukafGNeN3nY1bdTgQAAA0E"], referer: http://paramountestate.com
[Mon Nov 17 19:27:37.260320 2025] [:error] [pid 32753:tid 32770] [client 162.214.73.91:33072] [client 162.214.73.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.214.73.91, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsGqU6YNqI5vkht9215PwAAA84"], referer: http://paramountestate.com
[Mon Nov 17 19:36:20.548910 2025] [:error] [pid 39537:tid 39555] [client 92.205.167.152:41386] [client 92.205.167.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.167.152, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsItIZRrh1pcrdcLB-5wgAAAM8"], referer: http://paramountestate.com
[Mon Nov 17 19:39:38.446886 2025] [:error] [pid 30801:tid 30826] [client 125.75.66.97:36203] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRsJejbGAU49DhMTBD7suQAAAlc"]
[Mon Nov 17 19:45:04.574441 2025] [:error] [pid 40548:tid 40562] [client 157.230.20.249:36472] [client 157.230.20.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.20.249, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsKwAM_PykfYnxh-j9qYwAAAQw"], referer: http://paramountestate.com
[Mon Nov 17 20:03:03.992715 2025] [:error] [pid 32753:tid 32778] [client 8.137.149.112:36628] [client 8.137.149.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.137.149.112, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsO906YNqI5vkht922EnAAAA9Y"], referer: http://paramountestate.com
[Mon Nov 17 20:11:41.633321 2025] [:error] [pid 15888:tid 15915] [client 173.236.218.94:48252] [client 173.236.218.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.218.94, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsQ_QjAdDTBm4W3qW04wwAAAdg"], referer: http://paramountestate.com
[Mon Nov 17 20:17:12.998237 2025] [:error] [pid 20913:tid 20928] [client 158.220.121.230:39068] [client 158.220.121.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.220.121.230, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsSSOkafGNeN3nY1bddoAAAA00"]
[Mon Nov 17 20:38:39.867193 2025] [:error] [pid 32753:tid 32760] [client 51.77.245.241:48634] [client 51.77.245.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.77.245.241, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsXT06YNqI5vkht922NAQAAA8Q"], referer: http://paramountestate.com
[Mon Nov 17 20:47:26.441905 2025] [:error] [pid 39537:tid 39563] [client 92.205.167.152:40562] [client 92.205.167.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.167.152, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsZXoZRrh1pcrdcLB_DRQAAANc"], referer: http://paramountestate.com
[Mon Nov 17 20:55:57.859807 2025] [:error] [pid 39449:tid 39457] [client 104.234.19.42:29909] [client 104.234.19.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/txets.php"] [unique_id "aRsbXaUCymTA3MDfzLNmVwAAAAM"]
[Mon Nov 17 20:55:58.350641 2025] [:error] [pid 32753:tid 32759] [client 193.36.224.103:42257] [client 193.36.224.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/txets.php"] [unique_id "aRsbXk6YNqI5vkht922RtQAAA8M"]
[Mon Nov 17 20:55:58.843543 2025] [:error] [pid 39451:tid 39510] [client 104.234.19.45:59813] [client 104.234.19.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-admin/txets.php"] [unique_id "aRsbXufgkqXTS0SO3fApIwAAAII"]
[Mon Nov 17 20:56:13.682431 2025] [:error] [pid 39449:tid 39468] [client 51.81.207.12:36964] [client 51.81.207.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.81.207.12, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsbbaUCymTA3MDfzLNmXwAAAA4"], referer: http://paramountestate.com
[Mon Nov 17 21:05:09.812653 2025] [:error] [pid 65302:tid 65310] [client 103.92.85.202:37438] [client 103.92.85.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.92.85.202, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsdhQPMSx2v85r8y7wMrAAAAUY"], referer: http://paramountestate.com
[Mon Nov 17 21:14:04.029887 2025] [:error] [pid 20913:tid 20934] [client 89.46.109.92:28786] [client 89.46.109.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.109.92, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsfnOkafGNeN3nY1bdmAQAAA1M"], referer: http://paramountestate.com
[Mon Nov 17 21:31:50.895972 2025] [:error] [pid 39449:tid 39471] [client 139.59.66.202:53874] [client 139.59.66.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.66.202, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsjxqUCymTA3MDfzLNs3wAAABE"], referer: http://paramountestate.com
[Mon Nov 17 22:07:26.869792 2025] [:error] [pid 39451:tid 39517] [client 103.211.200.34:51802] [client 103.211.200.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.211.200.34, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRssHufgkqXTS0SO3fAxLgAAAIk"], referer: http://paramountestate.com
[Mon Nov 17 22:16:21.970160 2025] [:error] [pid 39449:tid 39476] [client 103.211.200.34:55890] [client 103.211.200.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.211.200.34, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRsuNaUCymTA3MDfzLN0bQAAABY"], referer: http://paramountestate.com
[Mon Nov 17 22:44:19.363584 2025] [:error] [pid 65302:tid 65316] [client 18.229.229.99:16133] [client 18.229.229.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.229.229.99, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRs0wwPMSx2v85r8y7waAwAAAUw"], referer: http://paramountestate.com
[Mon Nov 17 22:53:35.946201 2025] [:error] [pid 39449:tid 39472] [client 51.77.245.241:37350] [client 51.77.245.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.77.245.241, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRs276UCymTA3MDfzLN8gAAAABI"], referer: http://paramountestate.com
[Mon Nov 17 23:02:37.217885 2025] [:error] [pid 32753:tid 32761] [client 20.151.88.86:50434] [client 20.151.88.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.151.88.86, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRs5DU6YNqI5vkht922wwgAAA8U"], referer: http://paramountestate.com
[Mon Nov 17 23:05:16.428122 2025] [:error] [pid 15888:tid 15901] [client 68.183.41.247:38828] [client 68.183.41.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.41.247, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRs5rAjAdDTBm4W3qW1MogAAAco"]
[Mon Nov 17 23:29:19.760366 2025] [:error] [pid 30801:tid 30816] [client 47.238.97.17:59026] [client 47.238.97.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.238.97.17, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRs_TzbGAU49DhMTBD4LOgAAAk0"], referer: http://paramountestate.com
[Mon Nov 17 23:38:25.001656 2025] [:error] [pid 32753:tid 32765] [client 103.185.185.188:35508] [client 103.185.185.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.185.185.188, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtBcU6YNqI5vkht9226HwAAA8k"], referer: http://paramountestate.com
[Mon Nov 17 23:46:55.813581 2025] [:error] [pid 20913:tid 20919] [client 194.38.135.180:54822] [client 194.38.135.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.38.135.180, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtDb-kafGNeN3nY1bd97gAAA0Q"], referer: http://paramountestate.com
[Mon Nov 17 23:55:19.026265 2025] [:error] [pid 39537:tid 39548] [client 64.225.2.20:42974] [client 64.225.2.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.225.2.20, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtFZ4ZRrh1pcrdcLB_a9gAAAMg"], referer: http://paramountestate.com
[Tue Nov 18 00:12:50.608664 2025] [:error] [pid 30801:tid 30817] [client 138.68.227.197:41702] [client 138.68.227.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.227.197, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtJgjbGAU49DhMTBD4RAwAAAk4"], referer: http://paramountestate.com
[Tue Nov 18 00:30:07.434356 2025] [:error] [pid 40561:tid 40603] [client 173.236.154.166:48220] [client 173.236.154.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.154.166, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtNj5dU597fIdQPRD-unwAAAMc"], referer: http://paramountestate.com
[Tue Nov 18 00:53:20.750600 2025] [:error] [pid 40562:tid 40624] [client 103.75.187.239:34000] [client 103.75.187.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.187.239, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtTAB18kaCmPuHE4a8CMAAAAUE"], referer: http://paramountestate.com
[Tue Nov 18 01:01:13.571246 2025] [:error] [pid 40561:tid 40596] [client 203.217.101.237:41426] [client 203.217.101.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.217.101.237, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtU2ZdU597fIdQPRD-3-wAAAMA"], referer: http://paramountestate.com
[Tue Nov 18 01:17:34.533949 2025] [:error] [pid 39189:tid 39217] [client 162.241.216.83:40250] [client 162.241.216.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.83, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtYrpJJLi753QwyqGzWRQAAAJg"], referer: http://paramountestate.com
[Tue Nov 18 01:26:07.752654 2025] [:error] [pid 40553:tid 40585] [client 116.193.190.94:49440] [client 116.193.190.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.190.94, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtar9uLE1BqoX0RcsLnbwAAABA"], referer: http://paramountestate.com
[Tue Nov 18 01:41:31.049734 2025] [:error] [pid 39189:tid 39215] [client 70.40.255.4:42262] [client 70.40.255.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.40.255.4, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRteS5JJLi753QwyqGziJwAAAJY"], referer: http://paramountestate.com
[Tue Nov 18 01:56:45.173257 2025] [:error] [pid 39189:tid 39209] [client 165.22.223.164:56276] [client 165.22.223.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.223.164, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRth3ZJJLi753QwyqGzrCQAAAJA"], referer: http://paramountestate.com
[Tue Nov 18 02:04:22.860560 2025] [:error] [pid 40561:tid 40620] [client 157.245.109.248:47974] [client 157.245.109.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.109.248, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtjppdU597fIdQPRD_OgQAAANg"], referer: http://paramountestate.com
[Tue Nov 18 02:10:49.010447 2025] [:error] [pid 40561:tid 40596] [client 160.30.112.242:48388] [client 160.30.112.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.112.242, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtlKZdU597fIdQPRD_QFQAAAMA"]
[Tue Nov 18 02:12:36.505988 2025] [:error] [pid 40793:tid 40872] [client 142.44.138.99:52354] [client 142.44.138.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.44.138.99, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtllAzccxeNeH-NUVhAHwAAAFY"], referer: http://paramountestate.com
[Tue Nov 18 02:20:57.036505 2025] [:error] [pid 40793:tid 40855] [client 120.25.168.36:48404] [client 120.25.168.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.25.168.36, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtniQzccxeNeH-NUVhCpwAAAEU"], referer: http://paramountestate.com
[Tue Nov 18 02:28:46.681675 2025] [:error] [pid 39189:tid 39209] [client 162.241.244.19:36456] [client 162.241.244.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.244.19, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtpXpJJLi753QwyqGz6UQAAAJA"], referer: http://paramountestate.com
[Tue Nov 18 02:36:38.904654 2025] [:error] [pid 40553:tid 40576] [client 14.192.25.106:33276] [client 14.192.25.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.192.25.106, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtrNtuLE1BqoX0RcsL_VQAAAAc"], referer: http://paramountestate.com
[Tue Nov 18 02:44:08.824151 2025] [:error] [pid 24928:tid 24939] [client 23.137.84.82:41326] [client 23.137.84.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.137.84.82, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRts-Oe2a38O8HjCzurrKAAAAok"], referer: http://paramountestate.com
[Tue Nov 18 03:06:05.971207 2025] [:error] [pid 24898:tid 24917] [client 120.25.168.36:41652] [client 120.25.168.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.25.168.36, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtyHWQbwxb61buaxA9uggAAAlA"], referer: http://paramountestate.com
[Tue Nov 18 03:13:46.026030 2025] [:error] [pid 25055:tid 25102] [client 139.59.253.161:37494] [client 139.59.253.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.253.161, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRtz6i1ycIUMyo0DEcLu6gAAA9I"], referer: http://paramountestate.com
[Tue Nov 18 03:29:57.166326 2025] [:error] [pid 39637:tid 39689] [client 95.154.198.138:60208] [client 95.154.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.154.198.138, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRt3taVmhXKozkT7oyMXLAAAAEs"]
[Tue Nov 18 04:22:48.803766 2025] [:error] [pid 61482:tid 61508] [client 128.199.23.132:34948] [client 128.199.23.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.23.132, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRuEGPtNHsWZClVWav4rtwAAANU"], referer: http://paramountestate.com
[Tue Nov 18 04:31:00.403470 2025] [:error] [pid 61392:tid 61429] [client 113.192.8.160:35914] [client 113.192.8.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.192.8.160, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRuGBHSmvb496zZxueKyqwAAAEA"], referer: http://paramountestate.com
[Tue Nov 18 05:43:59.724436 2025] [:error] [pid 42804:tid 42808] [client 43.157.43.147:47970] [client 43.157.43.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRuXH_pXARlE6tIuBnlH0QAAAUI"]
[Tue Nov 18 05:45:44.614943 2025] [:error] [pid 42804:tid 42824] [client 152.42.168.23:57136] [client 152.42.168.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "aRuXiPpXARlE6tIuBnlIVwAAAVI"]
[Tue Nov 18 06:05:31.490397 2025] [:error] [pid 29195:tid 29204] [client 217.154.227.88:49198] [client 217.154.227.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.227.88, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRucKxMeonxy_4yeOTU2PQAAAQc"]
[Tue Nov 18 11:08:24.913326 2025] [:error] [pid 61392:tid 61439] [client 43.167.232.38:36632] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRvjKHSmvb496zZxueIfOQAAAEo"]
[Tue Nov 18 12:33:57.869435 2025] [:error] [pid 44624:tid 44643] [client 50.6.155.36:33766] [client 50.6.155.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.6.155.36, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRv3NSllffozoBluWCXrTgAAAZA"]
[Tue Nov 18 14:09:30.655930 2025] [:error] [pid 44624:tid 44643] [client 223.181.13.208:24720] [client 223.181.13.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.13.208, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRwNmillffozoBluWCUNlgAAAZA"]
[Tue Nov 18 21:37:31.180294 2025] [:error] [pid 44560:tid 44581] [client 45.134.79.103:52038] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRx2mwnbP7etF3q5-5vI6QAAAMo"]
[Tue Nov 18 21:37:31.835041 2025] [:error] [pid 44470:tid 44483] [client 45.134.79.103:60062] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRx2mzv-RLYfULjlgDb_YQAAAEg"]
[Tue Nov 18 21:37:32.507219 2025] [:error] [pid 44560:tid 44590] [client 45.134.79.103:53711] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2nAnbP7etF3q5-5vJAwAAANM"]
[Tue Nov 18 22:18:33.902762 2025] [:error] [pid 44471:tid 44517] [client 223.165.66.10:40332] [client 223.165.66.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.165.66.10, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aRyAOe_6m0bQO14XwtOPJwAAAQ0"]
[Tue Nov 18 23:29:52.408641 2025] [:error] [pid 44470:tid 44491] [client 43.163.206.70:43026] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aRyQ8Dv-RLYfULjlgDYiTwAAAFA"]
[Wed Nov 19 03:15:27.150729 2025] [:error] [pid 3052:tid 3137] [client 34.76.142.88:42606] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.76.142.88, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aRzFz1NM6bOMTTuJnz3AowAAAMg"], referer: http://paramountestate.com
[Wed Nov 19 03:28:07.854872 2025] [:error] [pid 14439:tid 14456] [client 182.42.111.156:51410] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aRzIx1at0cKFYVAxpdAHQgAAAQ8"]
[Wed Nov 19 03:33:54.157449 2025] [:error] [pid 43881:tid 43916] [client 103.124.95.168:37202] [client 103.124.95.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.168, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aRzKIn_TrIND5buvEycK7wAAAUM"], referer: http://paramountestate.com
[Wed Nov 19 03:59:45.154689 2025] [:error] [pid 52817:tid 52841] [client 77.68.76.200:50204] [client 77.68.76.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.68.76.200, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aRzQMaXbKs2PYLPddPYBIQAAABM"], referer: http://paramountestate.com
[Wed Nov 19 06:07:15.686325 2025] [:error] [pid 6554:tid 6577] [client 185.196.161.85:50868] [client 185.196.161.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.196.161.85, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aRzuE98rvPWLafJFqmU5wQAAABE"], referer: http://paramountestate.com
[Wed Nov 19 07:30:38.659159 2025] [:error] [pid 6919:tid 6929] [client 18.191.165.250:56486] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR0BnkYFdN1s_9xJVUmq_wAAAQc"]
[Wed Nov 19 07:30:39.049824 2025] [:error] [pid 6644:tid 6652] [client 18.191.165.250:56625] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR0Bn00i6Rf788MB6sbZvwAAAMY"]
[Wed Nov 19 07:30:39.443752 2025] [:error] [pid 6919:tid 6937] [client 18.191.165.250:56735] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrJgAAAQ8"]
[Wed Nov 19 07:30:39.840608 2025] [:error] [pid 6919:tid 6937] [client 18.191.165.250:56818] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrSQAAAQ8"]
[Wed Nov 19 07:30:40.243291 2025] [:error] [pid 26664:tid 26690] [client 18.191.165.250:56904] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR0BoIpWc1yoj2P7MeASCwAAAVY"]
[Wed Nov 19 08:23:19.655976 2025] [:error] [pid 6644:tid 6661] [client 169.224.104.152:39742] [client 169.224.104.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.224.104.152, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aR0N900i6Rf788MB6sbpSAAAAM8"]
[Wed Nov 19 09:31:03.867109 2025] [:error] [pid 26664:tid 26689] [client 182.42.105.144:43202] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR0d14pWc1yoj2P7MeBJLAAAAVU"]
[Wed Nov 19 11:44:08.812391 2025] [:error] [pid 6644:tid 6662] [client 4.240.89.23:38778] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.240.89.23, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aR09CE0i6Rf788MB6sYr7wAAANA"], referer: http://paramountestate.com
[Wed Nov 19 13:12:01.089492 2025] [:error] [pid 26664:tid 26688] [client 51.158.107.203:52634] [client 51.158.107.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.158.107.203, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aR1RoYpWc1yoj2P7MeC1dAAAAVQ"], referer: http://paramountestate.com
[Wed Nov 19 20:35:57.960688 2025] [:error] [pid 12672:tid 12691] [client 104.196.176.201:58232] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "aR25rf9vojl6X1cc5mUu0QAAAc4"]
[Thu Nov 20 02:24:02.928216 2025] [:error] [pid 50223:tid 50359] [client 91.92.242.56:56931] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LQj4iSUKl66cdvvbjsAAAAFg"]
[Thu Nov 20 02:24:03.491852 2025] [:error] [pid 8195:tid 8215] [client 91.92.242.56:57240] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LQys33_quRYR1WMaxMgAAAhI"]
[Thu Nov 20 02:24:04.056875 2025] [:error] [pid 8396:tid 8399] [client 91.92.242.56:57553] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LRIolA09HZQNzyMD1SwAAAsE"]
[Thu Nov 20 02:24:04.619939 2025] [:error] [pid 50210:tid 50311] [client 91.92.242.56:57879] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LRN9KVfTGhSw-ebvAWQAAAAU"]
[Thu Nov 20 03:15:46.367499 2025] [:error] [pid 50236:tid 50365] [client 43.157.82.252:54434] [client 43.157.82.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR4XYmT-l-atWVKihhs1EgAAAIM"]
[Thu Nov 20 04:35:38.407363 2025] [:error] [pid 55430:tid 55444] [client 182.42.111.156:56079] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aR4qGvPZXaIMEU4pE7sm_QAAAMs"]
[Thu Nov 20 06:39:08.187319 2025] [:error] [pid 34444:tid 34451] [client 43.157.188.74:58670] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aR5HDFNEol4jlmmA_GOdgwAAAUU"]
[Thu Nov 20 10:23:57.922240 2025] [:error] [pid 804:tid 841] [client 89.185.82.43:39224] [client 89.185.82.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aR57vfaRHpUlPL9O0Lkh0wAAAZE"]
[Thu Nov 20 12:10:22.186477 2025] [:error] [pid 55340:tid 55350] [client 98.81.111.26:59261] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6UrvOxD-NeMydTybBJ3gAAAAU"]
[Thu Nov 20 12:10:22.598473 2025] [:error] [pid 34444:tid 34457] [client 98.81.111.26:51024] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6UrlNEol4jlmmA_GPw8AAAAUs"]
[Thu Nov 20 12:10:23.007020 2025] [:error] [pid 34405:tid 34426] [client 98.81.111.26:64262] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJUQAAARM"]
[Thu Nov 20 12:10:23.435854 2025] [:error] [pid 34405:tid 34417] [client 98.81.111.26:56303] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJZgAAAQo"]
[Thu Nov 20 12:10:23.881605 2025] [:error] [pid 34405:tid 34407] [client 98.81.111.26:57591] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJfQAAAQA"]
[Thu Nov 20 12:15:52.106143 2025] [:error] [pid 55430:tid 55457] [client 98.81.111.26:60330] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6V-PPZXaIMEU4pE7umIAAAANg"]
[Thu Nov 20 12:15:52.517047 2025] [:error] [pid 55343:tid 55413] [client 98.81.111.26:62841] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6V-FWlO3EnyVMV7w5osgAAAI4"]
[Thu Nov 20 12:15:52.923133 2025] [:error] [pid 34405:tid 34426] [client 98.81.111.26:65027] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6V-DFpvu8oRK7ATfvNOQAAARM"]
[Thu Nov 20 12:15:53.341998 2025] [:error] [pid 55343:tid 55403] [client 98.81.111.26:50654] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6V-VWlO3EnyVMV7w5o1QAAAIQ"]
[Thu Nov 20 12:15:53.753278 2025] [:error] [pid 55340:tid 55364] [client 98.81.111.26:52667] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR6V-fOxD-NeMydTybBNlAAAABM"]
[Thu Nov 20 15:53:15.428774 2025] [:error] [pid 55430:tid 55444] [client 173.239.254.46:38253] [client 173.239.254.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.46, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aR7I6_PZXaIMEU4pE7vhVQAAAMs"]
[Thu Nov 20 23:07:51.318345 2025] [:error] [pid 55343:tid 55422] [client 103.176.11.32:5262] [client 103.176.11.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.176.11.32, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aR8ux1WlO3EnyVMV7w7fxQAAAJc"]
[Fri Nov 21 00:40:52.870990 2025] [:error] [pid 13506:tid 13676] [client 93.123.109.7:55946] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aR9ElKTbGYpGB-467xY5NQAAAAY"]
[Fri Nov 21 11:21:58.364504 2025] [:error] [pid 46276:tid 46297] [client 162.241.224.236:21560] [client 162.241.224.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.224.236, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aR_a1nbpxuSAfajqqKPJcwAAAg4"]
[Fri Nov 21 12:08:38.842617 2025] [:error] [pid 46237:tid 46240] [client 180.102.134.69:58849] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aR_lxio2qlis7MUDbMIt0AAAAcE"]
[Fri Nov 21 16:47:27.467639 2025] [:error] [pid 46939:tid 46950] [client 162.241.226.115:51672] [client 162.241.226.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.226.115, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSAnH-0OmVoxD4VZ_ZmLvgAAAUg"]
[Fri Nov 21 18:28:05.108470 2025] [:error] [pid 25431:tid 25487] [client 182.42.105.144:36353] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSA-tcklhXxmoIExII1tagAAAIA"]
[Fri Nov 21 18:31:40.759375 2025] [:error] [pid 25431:tid 25508] [client 208.109.34.209:54098] [client 208.109.34.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.34.209, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSA_jMklhXxmoIExII1uigAAAJU"]
[Fri Nov 21 18:45:46.030994 2025] [:error] [pid 25554:tid 25570] [client 104.28.208.84:11386] [client 104.28.208.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.208.84, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSBC2h-NtB-9AzFZrk6MBwAAAQw"]
[Fri Nov 21 20:12:45.975316 2025] [:error] [pid 25521:tid 25547] [client 124.217.53.252:26332] [client 124.217.53.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.217.53.252, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSBXPfhXnBMilDddn3VChAAAANg"]
[Fri Nov 21 20:14:47.251971 2025] [:error] [pid 25554:tid 25568] [client 196.216.80.124:49276] [client 196.216.80.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.216.80.124, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSBXtx-NtB-9AzFZrk6iRAAAAQo"]
[Fri Nov 21 22:49:30.920244 2025] [:error] [pid 25554:tid 25563] [client 43.167.157.80:33276] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSB7-h-NtB-9AzFZrk7LNwAAAQU"]
[Sat Nov 22 01:03:09.844494 2025] [:error] [pid 9180:tid 9196] [client 180.102.134.69:37909] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSCbTbrk9msixUFV2i-HBgAAAE4"]
[Sat Nov 22 01:38:41.457472 2025] [:error] [pid 49642:tid 49899] [client 45.55.158.254:34624] [client 45.55.158.254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aSCjoYOXTPSuQfgUUtWU7QAAAIg"]
[Sat Nov 22 02:08:32.207688 2025] [:error] [pid 49641:tid 49832] [client 103.12.76.247:58804] [client 103.12.76.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.12.76.247, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSCqoFnhuiDak938N_bIdAAAAAk"]
[Sat Nov 22 03:32:48.460681 2025] [:error] [pid 8970:tid 9025] [client 173.249.147.129:62123] [client 173.249.147.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.147.129, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSC-YJuSBcofSIY3VZB89gAAAE0"]
[Sat Nov 22 03:53:10.032736 2025] [:error] [pid 53477:tid 53481] [client 103.167.150.158:60292] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "aSDDJn7Lu30Ku9O40aKiSwAAAAA"]
[Sat Nov 22 03:53:28.426127 2025] [:error] [pid 53479:tid 53537] [client 45.55.158.254:38496] [client 45.55.158.254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aSDDOG6cicFF3Aas-oQ8KAAAAIE"]
[Sat Nov 22 05:01:51.641830 2025] [:error] [pid 25856:tid 25865] [client 43.156.202.34:51206] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSDTPxsTP0wy94zKUvGLDwAAAQc"]
[Sat Nov 22 05:08:09.575706 2025] [:error] [pid 25856:tid 25874] [client 74.176.50.59:39879] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSDUuRsTP0wy94zKUvGQ5QAAARA"]
[Sat Nov 22 05:08:10.189321 2025] [:error] [pid 53566:tid 53581] [client 74.176.50.59:13154] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSDUusbSHDBkRbwMbd4e6AAAAM0"]
[Sat Nov 22 05:08:10.787770 2025] [:error] [pid 25856:tid 25881] [client 74.176.50.59:25073] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSDUuhsTP0wy94zKUvGQ6AAAARc"]
[Sat Nov 22 05:08:11.029353 2025] [:error] [pid 53477:tid 53502] [client 74.176.50.59:54149] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSDUu37Lu30Ku9O40aLHdgAAABU"]
[Sat Nov 22 05:08:11.479421 2025] [:error] [pid 53478:tid 53522] [client 74.176.50.59:4207] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aSDUuwhUYdXBbQswAdT76gAAAE0"]
[Sat Nov 22 05:08:12.203874 2025] [:error] [pid 25856:tid 25865] [client 74.176.50.59:54182] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aSDUvBsTP0wy94zKUvGQ6wAAAQc"]
[Sat Nov 22 05:08:13.212932 2025] [:error] [pid 53478:tid 53531] [client 74.176.50.59:20551] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aSDUvQhUYdXBbQswAdT77gAAAFY"]
[Sat Nov 22 05:08:14.475739 2025] [:error] [pid 53566:tid 53571] [client 74.176.50.59:24064] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aSDUvsbSHDBkRbwMbd4fEQAAAMM"]
[Sat Nov 22 05:08:15.173336 2025] [:error] [pid 53478:tid 53517] [client 74.176.50.59:20552] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/log.php"] [unique_id "aSDUvwhUYdXBbQswAdT78QAAAEg"]
[Sat Nov 22 05:08:15.768668 2025] [:error] [pid 53479:tid 53554] [client 74.176.50.59:12232] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/log.php"] [unique_id "aSDUv26cicFF3Aas-oRgBgAAAJI"]
[Sat Nov 22 05:08:16.914729 2025] [:error] [pid 53566:tid 53589] [client 74.176.50.59:25267] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/log.php"] [unique_id "aSDUwMbSHDBkRbwMbd4fHQAAANU"]
[Sat Nov 22 05:08:17.989838 2025] [:error] [pid 53566:tid 53569] [client 74.176.50.59:26779] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/log.php"] [unique_id "aSDUwcbSHDBkRbwMbd4fHwAAAME"]
[Sat Nov 22 05:08:18.647331 2025] [:error] [pid 53477:tid 53493] [client 74.176.50.59:38037] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/index.php"] [unique_id "aSDUwn7Lu30Ku9O40aLHjwAAAAw"]
[Sat Nov 22 05:08:19.245777 2025] [:error] [pid 53477:tid 53486] [client 74.176.50.59:13175] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/index.php"] [unique_id "aSDUw37Lu30Ku9O40aLHkAAAAAU"]
[Sat Nov 22 05:08:20.201847 2025] [:error] [pid 53478:tid 53510] [client 74.176.50.59:20572] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/index.php"] [unique_id "aSDUxAhUYdXBbQswAdT8AAAAAEE"]
[Sat Nov 22 05:08:21.002726 2025] [:error] [pid 25856:tid 25871] [client 74.176.50.59:44183] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/index.php"] [unique_id "aSDUxRsTP0wy94zKUvGRBwAAAQ0"]
[Sat Nov 22 05:08:21.775727 2025] [:error] [pid 53478:tid 53521] [client 74.176.50.59:26824] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aSDUxQhUYdXBbQswAdT8BgAAAEw"]
[Sat Nov 22 05:08:22.163701 2025] [:error] [pid 53479:tid 53553] [client 74.176.50.59:20561] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aSDUxm6cicFF3Aas-oRgFQAAAJE"]
[Sat Nov 22 05:08:22.887343 2025] [:error] [pid 53566:tid 53584] [client 74.176.50.59:51737] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aSDUxsbSHDBkRbwMbd4fNAAAANA"]
[Sat Nov 22 05:08:23.380008 2025] [:error] [pid 25856:tid 25869] [client 74.176.50.59:4812] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "aSDUxxsTP0wy94zKUvGRDwAAAQs"]
[Sat Nov 22 05:08:23.917617 2025] [:error] [pid 53478:tid 53515] [client 74.176.50.59:56377] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lufix.php"] [unique_id "aSDUxwhUYdXBbQswAdT8CwAAAEY"]
[Sat Nov 22 05:08:24.799924 2025] [:error] [pid 53479:tid 53541] [client 74.176.50.59:25060] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lufix.php"] [unique_id "aSDUyG6cicFF3Aas-oRgGwAAAIU"]
[Sat Nov 22 05:08:25.580744 2025] [:error] [pid 53478:tid 53510] [client 74.176.50.59:53074] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lufix.php"] [unique_id "aSDUyQhUYdXBbQswAdT8DgAAAEE"]
[Sat Nov 22 05:08:26.259770 2025] [:error] [pid 53479:tid 53546] [client 74.176.50.59:53095] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lufix.php"] [unique_id "aSDUym6cicFF3Aas-oRgIgAAAIo"]
[Sat Nov 22 05:08:26.658924 2025] [:error] [pid 53478:tid 53516] [client 74.176.50.59:43914] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "aSDUyghUYdXBbQswAdT8DwAAAEc"]
[Sat Nov 22 05:08:27.103195 2025] [:error] [pid 53477:tid 53481] [client 74.176.50.59:43927] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "aSDUy37Lu30Ku9O40aLHowAAAAA"]
[Sat Nov 22 05:08:27.405930 2025] [:error] [pid 53479:tid 53547] [client 74.176.50.59:56382] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "aSDUy26cicFF3Aas-oRgJgAAAIs"]
[Sat Nov 22 05:08:27.788654 2025] [:error] [pid 53477:tid 53495] [client 74.176.50.59:53244] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "aSDUy37Lu30Ku9O40aLHpwAAAA4"]
[Sat Nov 22 05:08:28.843694 2025] [:error] [pid 53477:tid 53489] [client 74.176.50.59:25037] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bak.php"] [unique_id "aSDUzH7Lu30Ku9O40aLHrAAAAAg"]
[Sat Nov 22 05:08:29.284188 2025] [:error] [pid 53477:tid 53494] [client 74.176.50.59:24098] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bak.php"] [unique_id "aSDUzX7Lu30Ku9O40aLHrwAAAA0"]
[Sat Nov 22 05:08:29.554999 2025] [:error] [pid 53478:tid 53517] [client 74.176.50.59:54198] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bak.php"] [unique_id "aSDUzQhUYdXBbQswAdT8FQAAAEg"]
[Sat Nov 22 05:08:30.324746 2025] [:error] [pid 53478:tid 53525] [client 74.176.50.59:4753] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bak.php"] [unique_id "aSDUzghUYdXBbQswAdT8FwAAAFA"]
[Sat Nov 22 05:08:31.453951 2025] [:error] [pid 53566:tid 53572] [client 74.176.50.59:13120] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/content.php"] [unique_id "aSDUz8bSHDBkRbwMbd4fTgAAAMQ"]
[Sat Nov 22 05:08:31.957740 2025] [:error] [pid 53477:tid 53495] [client 74.176.50.59:54193] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/content.php"] [unique_id "aSDUz37Lu30Ku9O40aLHtQAAAA4"]
[Sat Nov 22 05:08:32.484981 2025] [:error] [pid 53477:tid 53485] [client 74.176.50.59:26794] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/content.php"] [unique_id "aSDU0H7Lu30Ku9O40aLHtgAAAAQ"]
[Sat Nov 22 05:08:32.769171 2025] [:error] [pid 53478:tid 53512] [client 74.176.50.59:56333] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/content.php"] [unique_id "aSDU0AhUYdXBbQswAdT8HgAAAEM"]
[Sat Nov 22 05:08:33.174315 2025] [:error] [pid 53477:tid 53501] [client 74.176.50.59:53072] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/upfile.php"] [unique_id "aSDU0X7Lu30Ku9O40aLHuwAAABQ"]
[Sat Nov 22 05:08:34.230974 2025] [:error] [pid 25856:tid 25880] [client 74.176.50.59:54780] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/upfile.php"] [unique_id "aSDU0hsTP0wy94zKUvGRLwAAARY"]
[Sat Nov 22 05:08:34.989802 2025] [:error] [pid 53477:tid 53491] [client 74.176.50.59:26757] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/upfile.php"] [unique_id "aSDU0n7Lu30Ku9O40aLHwAAAAAo"]
[Sat Nov 22 05:08:36.047358 2025] [:error] [pid 25856:tid 25869] [client 74.176.50.59:54174] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/upfile.php"] [unique_id "aSDU1BsTP0wy94zKUvGRNAAAAQs"]
[Sat Nov 22 05:08:36.629885 2025] [:error] [pid 53479:tid 53552] [client 74.176.50.59:27390] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp.php"] [unique_id "aSDU1G6cicFF3Aas-oRgPQAAAJA"]
[Sat Nov 22 05:08:37.725902 2025] [:error] [pid 53566:tid 53573] [client 74.176.50.59:4766] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp.php"] [unique_id "aSDU1cbSHDBkRbwMbd4fbgAAAMU"]
[Sat Nov 22 05:08:38.717678 2025] [:error] [pid 53479:tid 53549] [client 74.176.50.59:27344] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp.php"] [unique_id "aSDU1m6cicFF3Aas-oRgQQAAAI0"]
[Sat Nov 22 05:08:39.546995 2025] [:error] [pid 25856:tid 25860] [client 74.176.50.59:26826] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp.php"] [unique_id "aSDU1xsTP0wy94zKUvGROgAAAQI"]
[Sat Nov 22 05:08:40.237953 2025] [:error] [pid 25856:tid 25878] [client 74.176.50.59:25238] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-conflg.php"] [unique_id "aSDU2BsTP0wy94zKUvGRPgAAARQ"]
[Sat Nov 22 05:08:40.714782 2025] [:error] [pid 53479:tid 53555] [client 74.176.50.59:53241] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-conflg.php"] [unique_id "aSDU2G6cicFF3Aas-oRgRwAAAJM"]
[Sat Nov 22 05:08:41.165874 2025] [:error] [pid 25856:tid 25880] [client 74.176.50.59:51714] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-conflg.php"] [unique_id "aSDU2RsTP0wy94zKUvGRQAAAARY"]
[Sat Nov 22 05:08:42.019786 2025] [:error] [pid 53479:tid 53552] [client 74.176.50.59:38045] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-conflg.php"] [unique_id "aSDU2m6cicFF3Aas-oRgTAAAAJA"]
[Sat Nov 22 05:08:42.752802 2025] [:error] [pid 53477:tid 53504] [client 74.176.50.59:54148] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bypass.php"] [unique_id "aSDU2n7Lu30Ku9O40aLH0gAAABc"]
[Sat Nov 22 05:08:43.573448 2025] [:error] [pid 53566:tid 53584] [client 74.176.50.59:54146] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bypass.php"] [unique_id "aSDU28bSHDBkRbwMbd4fgwAAANA"]
[Sat Nov 22 05:08:44.430101 2025] [:error] [pid 53479:tid 53549] [client 74.176.50.59:20330] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bypass.php"] [unique_id "aSDU3G6cicFF3Aas-oRgUgAAAI0"]
[Sat Nov 22 05:08:45.575022 2025] [:error] [pid 25856:tid 25860] [client 74.176.50.59:4802] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bypass.php"] [unique_id "aSDU3RsTP0wy94zKUvGRTgAAAQI"]
[Sat Nov 22 05:08:46.496434 2025] [:error] [pid 53479:tid 53545] [client 74.176.50.59:4417] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-activate.php"] [unique_id "aSDU3m6cicFF3Aas-oRgWQAAAIk"]
[Sat Nov 22 05:08:46.932759 2025] [:error] [pid 25856:tid 25880] [client 74.176.50.59:4462] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-activate.php"] [unique_id "aSDU3hsTP0wy94zKUvGRUgAAARY"]
[Sat Nov 22 05:08:48.215023 2025] [:error] [pid 53477:tid 53498] [client 74.176.50.59:56420] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-activate.php"] [unique_id "aSDU4H7Lu30Ku9O40aLH2gAAABE"]
[Sat Nov 22 05:08:50.324131 2025] [:error] [pid 53477:tid 53497] [client 74.176.50.59:43107] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-activate.php"] [unique_id "aSDU4n7Lu30Ku9O40aLH4AAAABA"]
[Sat Nov 22 05:08:51.174994 2025] [:error] [pid 53566:tid 53575] [client 74.176.50.59:38054] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSDU48bSHDBkRbwMbd4fmAAAAMc"]
[Sat Nov 22 05:08:52.103148 2025] [:error] [pid 53477:tid 53484] [client 74.176.50.59:56406] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSDU5H7Lu30Ku9O40aLH5gAAAAM"]
[Sat Nov 22 05:08:53.176011 2025] [:error] [pid 53478:tid 53517] [client 74.176.50.59:43118] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSDU5QhUYdXBbQswAdT8ZAAAAEg"]
[Sat Nov 22 05:08:53.725935 2025] [:error] [pid 25856:tid 25881] [client 74.176.50.59:20334] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSDU5RsTP0wy94zKUvGRYwAAARc"]
[Sat Nov 22 05:08:54.773639 2025] [:error] [pid 53566:tid 53580] [client 74.176.50.59:25155] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/updates.php"] [unique_id "aSDU5sbSHDBkRbwMbd4fnwAAAMw"]
[Sat Nov 22 05:08:55.553741 2025] [:error] [pid 53477:tid 53481] [client 74.176.50.59:26680] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/updates.php"] [unique_id "aSDU537Lu30Ku9O40aLH7QAAAAA"]
[Sat Nov 22 05:08:56.416691 2025] [:error] [pid 53566:tid 53582] [client 74.176.50.59:26855] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/updates.php"] [unique_id "aSDU6MbSHDBkRbwMbd4fpQAAAM4"]
[Sat Nov 22 05:08:57.175913 2025] [:error] [pid 53478:tid 53526] [client 74.176.50.59:25105] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/updates.php"] [unique_id "aSDU6QhUYdXBbQswAdT8cgAAAFE"]
[Sat Nov 22 05:08:57.946827 2025] [:error] [pid 53478:tid 53516] [client 74.176.50.59:38070] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/radio.php"] [unique_id "aSDU6QhUYdXBbQswAdT8dgAAAEc"]
[Sat Nov 22 05:08:58.519850 2025] [:error] [pid 25856:tid 25879] [client 74.176.50.59:43122] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/radio.php"] [unique_id "aSDU6hsTP0wy94zKUvGRfQAAARU"]
[Sat Nov 22 05:08:58.892204 2025] [:error] [pid 53478:tid 53522] [client 74.176.50.59:25183] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/radio.php"] [unique_id "aSDU6ghUYdXBbQswAdT8eAAAAE0"]
[Sat Nov 22 05:08:59.878418 2025] [:error] [pid 53479:tid 53555] [client 74.176.50.59:26490] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/radio.php"] [unique_id "aSDU626cicFF3Aas-oRgcQAAAJM"]
[Sat Nov 22 05:09:00.460314 2025] [:error] [pid 53479:tid 53545] [client 74.176.50.59:38046] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins.php"] [unique_id "aSDU7G6cicFF3Aas-oRgdQAAAIk"]
[Sat Nov 22 05:09:01.087052 2025] [:error] [pid 53477:tid 53495] [client 74.176.50.59:26455] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins.php"] [unique_id "aSDU7X7Lu30Ku9O40aLH9AAAAA4"]
[Sat Nov 22 05:09:01.846968 2025] [:error] [pid 53479:tid 53550] [client 74.176.50.59:25134] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins.php"] [unique_id "aSDU7W6cicFF3Aas-oRgdgAAAI4"]
[Sat Nov 22 05:09:02.287027 2025] [:error] [pid 53478:tid 53510] [client 74.176.50.59:56442] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins.php"] [unique_id "aSDU7ghUYdXBbQswAdT8iwAAAEE"]
[Sat Nov 22 05:09:03.590853 2025] [:error] [pid 53478:tid 53517] [client 74.176.50.59:26485] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmrlpc.php"] [unique_id "aSDU7whUYdXBbQswAdT8kwAAAEg"]
[Sat Nov 22 05:09:04.189845 2025] [:error] [pid 53478:tid 53526] [client 74.176.50.59:53222] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmrlpc.php"] [unique_id "aSDU8AhUYdXBbQswAdT8lAAAAFE"]
[Sat Nov 22 05:09:04.679907 2025] [:error] [pid 53478:tid 53524] [client 74.176.50.59:26822] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmrlpc.php"] [unique_id "aSDU8AhUYdXBbQswAdT8lwAAAE8"]
[Sat Nov 22 05:09:05.679131 2025] [:error] [pid 53479:tid 53546] [client 74.176.50.59:52662] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmrlpc.php"] [unique_id "aSDU8W6cicFF3Aas-oRgfAAAAIo"]
[Sat Nov 22 05:09:46.382011 2025] [:error] [pid 25856:tid 25862] [client 74.176.50.59:35398] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wso112233.php"] [unique_id "aSDVGhsTP0wy94zKUvGSFgAAAQQ"]
[Sat Nov 22 05:09:47.136666 2025] [:error] [pid 25856:tid 25870] [client 74.176.50.59:37870] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wso112233.php"] [unique_id "aSDVGxsTP0wy94zKUvGSGgAAAQw"]
[Sat Nov 22 05:09:47.906200 2025] [:error] [pid 53566:tid 53591] [client 74.176.50.59:24337] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wso112233.php"] [unique_id "aSDVG8bSHDBkRbwMbd4gLQAAANc"]
[Sat Nov 22 05:09:49.224986 2025] [:error] [pid 53566:tid 53572] [client 74.176.50.59:52265] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wso112233.php"] [unique_id "aSDVHcbSHDBkRbwMbd4gMQAAAMQ"]
[Sat Nov 22 05:09:50.385137 2025] [:error] [pid 53479:tid 53546] [client 74.176.50.59:48326] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-atom.php"] [unique_id "aSDVHm6cicFF3Aas-oRhFgAAAIo"]
[Sat Nov 22 05:09:51.491820 2025] [:error] [pid 53477:tid 53486] [client 74.176.50.59:36825] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-atom.php"] [unique_id "aSDVH37Lu30Ku9O40aLIjAAAAAU"]
[Sat Nov 22 05:09:52.137252 2025] [:error] [pid 53566:tid 53577] [client 74.176.50.59:37841] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-atom.php"] [unique_id "aSDVIMbSHDBkRbwMbd4gOAAAAMk"]
[Sat Nov 22 05:09:53.331236 2025] [:error] [pid 53479:tid 53536] [client 74.176.50.59:48347] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-atom.php"] [unique_id "aSDVIW6cicFF3Aas-oRhJQAAAIA"]
[Sat Nov 22 05:09:54.295883 2025] [:error] [pid 53566:tid 53585] [client 74.176.50.59:12122] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfanew.php"] [unique_id "aSDVIsbSHDBkRbwMbd4gRAAAANE"]
[Sat Nov 22 05:09:54.736127 2025] [:error] [pid 53478:tid 53512] [client 74.176.50.59:18720] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfanew.php"] [unique_id "aSDVIghUYdXBbQswAdT9SwAAAEM"]
[Sat Nov 22 05:09:55.102228 2025] [:error] [pid 53478:tid 53531] [client 74.176.50.59:52266] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfanew.php"] [unique_id "aSDVIwhUYdXBbQswAdT9TgAAAFY"]
[Sat Nov 22 05:09:55.537197 2025] [:error] [pid 53479:tid 53542] [client 74.176.50.59:16242] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfanew.php"] [unique_id "aSDVI26cicFF3Aas-oRhLwAAAIY"]
[Sat Nov 22 05:09:56.035240 2025] [:error] [pid 53566:tid 53576] [client 74.176.50.59:37864] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fw.php"] [unique_id "aSDVJMbSHDBkRbwMbd4gTAAAAMg"]
[Sat Nov 22 05:09:57.091712 2025] [:error] [pid 25856:tid 25880] [client 74.176.50.59:16227] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fw.php"] [unique_id "aSDVJRsTP0wy94zKUvGSKgAAARY"]
[Sat Nov 22 05:09:57.900167 2025] [:error] [pid 53478:tid 53512] [client 74.176.50.59:48381] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fw.php"] [unique_id "aSDVJQhUYdXBbQswAdT9WwAAAEM"]
[Sat Nov 22 05:09:58.625830 2025] [:error] [pid 53478:tid 53533] [client 74.176.50.59:16250] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fw.php"] [unique_id "aSDVJghUYdXBbQswAdT9XgAAAFg"]
[Sat Nov 22 05:09:58.921768 2025] [:error] [pid 53478:tid 53524] [client 74.176.50.59:14560] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/install.php"] [unique_id "aSDVJghUYdXBbQswAdT9YAAAAE8"]
[Sat Nov 22 05:09:59.343108 2025] [:error] [pid 53479:tid 53552] [client 74.176.50.59:36855] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/install.php"] [unique_id "aSDVJ26cicFF3Aas-oRhOAAAAJA"]
[Sat Nov 22 05:09:59.909918 2025] [:error] [pid 53479:tid 53544] [client 74.176.50.59:16236] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/install.php"] [unique_id "aSDVJ26cicFF3Aas-oRhPQAAAIg"]
[Sat Nov 22 05:10:00.845333 2025] [:error] [pid 25856:tid 25874] [client 74.176.50.59:41899] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/install.php"] [unique_id "aSDVKBsTP0wy94zKUvGSMwAAARA"]
[Sat Nov 22 05:10:02.124955 2025] [:error] [pid 53477:tid 53502] [client 74.176.50.59:37836] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSDVKn7Lu30Ku9O40aLIpAAAABU"]
[Sat Nov 22 05:10:03.214011 2025] [:error] [pid 53479:tid 53552] [client 74.176.50.59:16195] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSDVK26cicFF3Aas-oRhQgAAAJA"]
[Sat Nov 22 05:10:03.525179 2025] [:error] [pid 53478:tid 53526] [client 74.176.50.59:36824] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSDVKwhUYdXBbQswAdT9cgAAAFE"]
[Sat Nov 22 05:10:03.859897 2025] [:error] [pid 25856:tid 25864] [client 74.176.50.59:18746] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSDVKxsTP0wy94zKUvGSOgAAAQY"]
[Sat Nov 22 05:10:04.273429 2025] [:error] [pid 25856:tid 25865] [client 74.176.50.59:41896] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "aSDVLBsTP0wy94zKUvGSPAAAAQc"]
[Sat Nov 22 05:10:04.646866 2025] [:error] [pid 25856:tid 25872] [client 74.176.50.59:12120] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "aSDVLBsTP0wy94zKUvGSPQAAAQ4"]
[Sat Nov 22 05:10:05.199741 2025] [:error] [pid 25856:tid 25863] [client 74.176.50.59:52249] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "aSDVLRsTP0wy94zKUvGSPwAAAQU"]
[Sat Nov 22 05:10:05.527962 2025] [:error] [pid 25856:tid 25878] [client 74.176.50.59:16240] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "aSDVLRsTP0wy94zKUvGSQAAAARQ"]
[Sat Nov 22 05:10:06.497828 2025] [:error] [pid 53479:tid 53554] [client 74.176.50.59:14550] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aSDVLm6cicFF3Aas-oRhRQAAAJI"]
[Sat Nov 22 05:10:07.308737 2025] [:error] [pid 53477:tid 53505] [client 74.176.50.59:12126] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aSDVL37Lu30Ku9O40aLItAAAABg"]
[Sat Nov 22 05:10:07.949748 2025] [:error] [pid 53477:tid 53497] [client 74.176.50.59:36800] [client 74.176.50.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "aSDVL37Lu30Ku9O40aLItgAAABA"]
[Sat Nov 22 06:56:50.982609 2025] [:error] [pid 9547:tid 9566] [client 212.116.231.26:46440] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSDuMtClOR5qk7DoMeGl-QAAAU0"]
[Sat Nov 22 06:56:51.815105 2025] [:error] [pid 53477:tid 53492] [client 212.116.231.26:46932] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSDuM37Lu30Ku9O40aIHLgAAAAs"]
[Sat Nov 22 06:56:52.628644 2025] [:error] [pid 9547:tid 9567] [client 212.116.231.26:47364] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSDuNNClOR5qk7DoMeGmGgAAAU4"]
[Sat Nov 22 06:56:53.439288 2025] [:error] [pid 53566:tid 53591] [client 212.116.231.26:47818] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSDuNcbSHDBkRbwMbd5oAgAAANc"]
[Sat Nov 22 06:56:54.260430 2025] [:error] [pid 9547:tid 9560] [client 212.116.231.26:48208] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSDuNtClOR5qk7DoMeGmNwAAAUc"]
[Sat Nov 22 06:56:55.078670 2025] [:error] [pid 9547:tid 9571] [client 212.116.231.26:48568] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuN9ClOR5qk7DoMeGmSQAAAVI"]
[Sat Nov 22 06:56:55.911096 2025] [:error] [pid 53478:tid 53532] [client 212.116.231.26:48884] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuNwhUYdXBbQswAdRAiwAAAFc"]
[Sat Nov 22 06:56:56.722851 2025] [:error] [pid 25856:tid 25877] [client 212.116.231.26:49098] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOBsTP0wy94zKUvHoOwAAARM"]
[Sat Nov 22 06:56:57.535461 2025] [:error] [pid 25856:tid 25859] [client 212.116.231.26:49268] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuORsTP0wy94zKUvHoRwAAAQE"]
[Sat Nov 22 06:56:58.349021 2025] [:error] [pid 25856:tid 25869] [client 212.116.231.26:49404] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOhsTP0wy94zKUvHoTAAAAQs"]
[Sat Nov 22 10:45:27.310274 2025] [:error] [pid 9547:tid 9568] [client 194.5.82.163:24177] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSEjx9ClOR5qk7DoMeEUqgAAAU8"]
[Sat Nov 22 17:52:44.351119 2025] [:error] [pid 53477:tid 53490] [client 103.204.38.151:50664] [client 103.204.38.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.204.38.151, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSGH7H7Lu30Ku9O40aKqhAAAAAk"]
[Sat Nov 22 20:02:20.810694 2025] [:error] [pid 9547:tid 9565] [client 159.203.89.146:33046] [client 159.203.89.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aSGmTNClOR5qk7DoMeHVFwAAAUw"]
[Sat Nov 22 20:08:20.527504 2025] [:error] [pid 25856:tid 25878] [client 75.119.208.120:32822] [client 75.119.208.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.119.208.120, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSGntBsTP0wy94zKUvHW2AAAARQ"]
[Sat Nov 22 22:22:31.631029 2025] [:error] [pid 9547:tid 9556] [client 159.203.89.146:38762] [client 159.203.89.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aSHHJ9ClOR5qk7DoMeEInAAAAUM"]
[Sat Nov 22 22:42:26.481626 2025] [:error] [pid 9547:tid 9558] [client 48.210.12.181:46079] [client 48.210.12.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aSHL0tClOR5qk7DoMeEPLwAAAUU"]
[Sat Nov 22 22:42:30.656114 2025] [:error] [pid 53477:tid 53485] [client 48.210.12.181:46033] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/re.php"] [unique_id "aSHL1n7Lu30Ku9O40aL_vQAAAAQ"]
[Sat Nov 22 22:42:30.899701 2025] [:error] [pid 53477:tid 53481] [client 48.210.12.181:46076] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/re.php"] [unique_id "aSHL1n7Lu30Ku9O40aL_vgAAAAA"]
[Sat Nov 22 22:42:31.153439 2025] [:error] [pid 53477:tid 53505] [client 48.210.12.181:46070] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/re.php"] [unique_id "aSHL137Lu30Ku9O40aL_vwAAABg"]
[Sat Nov 22 22:42:31.422476 2025] [:error] [pid 9547:tid 9572] [client 48.210.12.181:45970] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/re.php"] [unique_id "aSHL19ClOR5qk7DoMeEPMQAAAVM"]
[Sat Nov 22 22:42:31.658497 2025] [:error] [pid 53479:tid 53546] [client 48.210.12.181:46074] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminer.php"] [unique_id "aSHL126cicFF3Aas-oTebgAAAIo"]
[Sat Nov 22 22:42:31.962762 2025] [:error] [pid 9547:tid 9567] [client 48.210.12.181:45980] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminer.php"] [unique_id "aSHL19ClOR5qk7DoMeEPNAAAAU4"]
[Sat Nov 22 22:42:32.205964 2025] [:error] [pid 9547:tid 9577] [client 48.210.12.181:46073] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminer.php"] [unique_id "aSHL2NClOR5qk7DoMeEPNgAAAVg"]
[Sat Nov 22 22:42:32.440044 2025] [:error] [pid 53479:tid 53553] [client 48.210.12.181:46035] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminer.php"] [unique_id "aSHL2G6cicFF3Aas-oTebwAAAJE"]
[Sat Nov 22 22:42:32.679775 2025] [:error] [pid 25856:tid 25877] [client 48.210.12.181:46077] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "aSHL2BsTP0wy94zKUvEDVQAAARM"]
[Sat Nov 22 22:42:32.986580 2025] [:error] [pid 44259:tid 44282] [client 48.210.12.181:45952] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "aSHL2HXe1xL-_YOdRmTnIQAAAZQ"]
[Sat Nov 22 22:42:33.238074 2025] [:error] [pid 44259:tid 44275] [client 48.210.12.181:46062] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "aSHL2XXe1xL-_YOdRmTnIgAAAY0"]
[Sat Nov 22 22:42:33.519282 2025] [:error] [pid 44259:tid 44277] [client 48.210.12.181:46069] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "aSHL2XXe1xL-_YOdRmTnJAAAAY8"]
[Sat Nov 22 22:42:33.763604 2025] [:error] [pid 25856:tid 25875] [client 48.210.12.181:45963] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aSHL2RsTP0wy94zKUvEDVgAAARE"]
[Sat Nov 22 22:42:34.002978 2025] [:error] [pid 53566:tid 53589] [client 48.210.12.181:46055] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aSHL2sbSHDBkRbwMbd5xXQAAANU"]
[Sat Nov 22 22:42:34.286423 2025] [:error] [pid 9547:tid 9568] [client 48.210.12.181:46036] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aSHL2tClOR5qk7DoMeEPOwAAAU8"]
[Sat Nov 22 22:42:34.538584 2025] [:error] [pid 44259:tid 44285] [client 48.210.12.181:46058] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file7.php"] [unique_id "aSHL2nXe1xL-_YOdRmTnJgAAAZc"]
[Sat Nov 22 22:42:34.774953 2025] [:error] [pid 9547:tid 9558] [client 48.210.12.181:46017] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSHL2tClOR5qk7DoMeEPPQAAAUU"]
[Sat Nov 22 22:42:35.073299 2025] [:error] [pid 53566:tid 53580] [client 48.210.12.181:46026] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSHL28bSHDBkRbwMbd5xYAAAAMw"]
[Sat Nov 22 22:42:35.301239 2025] [:error] [pid 53566:tid 53587] [client 48.210.12.181:46056] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSHL28bSHDBkRbwMbd5xYgAAANM"]
[Sat Nov 22 22:42:35.545937 2025] [:error] [pid 44259:tid 44265] [client 48.210.12.181:46063] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSHL23Xe1xL-_YOdRmTnJwAAAYM"]
[Sat Nov 22 22:42:35.777867 2025] [:error] [pid 44259:tid 44276] [client 48.210.12.181:46022] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless2.php"] [unique_id "aSHL23Xe1xL-_YOdRmTnKQAAAY4"]
[Sat Nov 22 22:42:36.109628 2025] [:error] [pid 53566:tid 53576] [client 48.210.12.181:45965] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless2.php"] [unique_id "aSHL3MbSHDBkRbwMbd5xZAAAAMg"]
[Sat Nov 22 22:42:36.402683 2025] [:error] [pid 9547:tid 9570] [client 48.210.12.181:46018] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless2.php"] [unique_id "aSHL3NClOR5qk7DoMeEPQQAAAVE"]
[Sat Nov 22 22:42:36.661960 2025] [:error] [pid 53477:tid 53486] [client 48.210.12.181:45974] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless2.php"] [unique_id "aSHL3H7Lu30Ku9O40aL_wQAAAAU"]
[Sat Nov 22 22:42:36.931172 2025] [:error] [pid 53477:tid 53499] [client 48.210.12.181:45956] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "aSHL3H7Lu30Ku9O40aL_wgAAABI"]
[Sat Nov 22 22:42:37.182029 2025] [:error] [pid 44259:tid 44266] [client 48.210.12.181:46043] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "aSHL3XXe1xL-_YOdRmTnKwAAAYQ"]
[Sat Nov 22 22:42:37.535848 2025] [:error] [pid 53566:tid 53578] [client 48.210.12.181:46027] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "aSHL3cbSHDBkRbwMbd5xZgAAAMo"]
[Sat Nov 22 22:42:37.868345 2025] [:error] [pid 53479:tid 53538] [client 48.210.12.181:46060] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "aSHL3W6cicFF3Aas-oTecAAAAII"]
[Sat Nov 22 22:42:38.121704 2025] [:error] [pid 25856:tid 25870] [client 48.210.12.181:46048] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "aSHL3hsTP0wy94zKUvEDWwAAAQw"]
[Sat Nov 22 22:42:38.423152 2025] [:error] [pid 53566:tid 53573] [client 48.210.12.181:46038] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "aSHL3sbSHDBkRbwMbd5xagAAAMU"]
[Sat Nov 22 22:42:38.663198 2025] [:error] [pid 53478:tid 53533] [client 48.210.12.181:45964] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "aSHL3ghUYdXBbQswAdQ5YAAAAFg"]
[Sat Nov 22 22:42:38.933954 2025] [:error] [pid 9547:tid 9569] [client 48.210.12.181:45971] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "aSHL3tClOR5qk7DoMeEPRAAAAVA"]
[Sat Nov 22 22:42:39.177314 2025] [:error] [pid 53479:tid 53554] [client 48.210.12.181:46020] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsa.php"] [unique_id "aSHL326cicFF3Aas-oTecgAAAJI"]
[Sat Nov 22 22:42:39.447872 2025] [:error] [pid 53566:tid 53584] [client 48.210.12.181:45957] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsa.php"] [unique_id "aSHL38bSHDBkRbwMbd5xbAAAANA"]
[Sat Nov 22 22:42:39.688382 2025] [:error] [pid 44259:tid 44278] [client 48.210.12.181:45960] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsa.php"] [unique_id "aSHL33Xe1xL-_YOdRmTnLQAAAZA"]
[Sat Nov 22 22:42:39.931337 2025] [:error] [pid 53566:tid 53585] [client 48.210.12.181:45896] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsa.php"] [unique_id "aSHL38bSHDBkRbwMbd5xbQAAANE"]
[Sat Nov 22 22:42:40.158814 2025] [:error] [pid 44259:tid 44286] [client 48.210.12.181:46059] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "aSHL4HXe1xL-_YOdRmTnLwAAAZg"]
[Sat Nov 22 22:42:40.407671 2025] [:error] [pid 25856:tid 25858] [client 48.210.12.181:45927] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "aSHL4BsTP0wy94zKUvEDXQAAAQA"]
[Sat Nov 22 22:42:40.642990 2025] [:error] [pid 53479:tid 53542] [client 48.210.12.181:46003] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "aSHL4G6cicFF3Aas-oTedQAAAIY"]
[Sat Nov 22 22:42:40.881358 2025] [:error] [pid 53479:tid 53536] [client 48.210.12.181:46045] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "aSHL4G6cicFF3Aas-oTedgAAAIA"]
[Sat Nov 22 22:42:41.126759 2025] [:error] [pid 53477:tid 53492] [client 48.210.12.181:45953] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSHL4X7Lu30Ku9O40aL_yAAAAAs"]
[Sat Nov 22 22:42:41.363617 2025] [:error] [pid 53477:tid 53481] [client 48.210.12.181:45983] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSHL4X7Lu30Ku9O40aL_yQAAAAA"]
[Sat Nov 22 22:42:41.606427 2025] [:error] [pid 9547:tid 9568] [client 48.210.12.181:46025] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSHL4dClOR5qk7DoMeEPRwAAAU8"]
[Sat Nov 22 22:42:41.833997 2025] [:error] [pid 9547:tid 9558] [client 48.210.12.181:46001] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSHL4dClOR5qk7DoMeEPSAAAAUU"]
[Sat Nov 22 22:42:42.068517 2025] [:error] [pid 44259:tid 44282] [client 48.210.12.181:46071] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSHL4nXe1xL-_YOdRmTnMwAAAZQ"]
[Sat Nov 22 22:42:42.317324 2025] [:error] [pid 9547:tid 9576] [client 48.210.12.181:46039] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSHL4tClOR5qk7DoMeEPSQAAAVc"]
[Sat Nov 22 22:42:42.568387 2025] [:error] [pid 9547:tid 9555] [client 48.210.12.181:46031] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSHL4tClOR5qk7DoMeEPSwAAAUI"]
[Sat Nov 22 22:42:42.803973 2025] [:error] [pid 44259:tid 44272] [client 48.210.12.181:46008] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSHL4nXe1xL-_YOdRmTnNgAAAYo"]
[Sat Nov 22 22:42:43.059965 2025] [:error] [pid 53478:tid 53530] [client 48.210.12.181:45961] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dejavu.php"] [unique_id "aSHL4whUYdXBbQswAdQ5YgAAAFU"]
[Sat Nov 22 22:42:43.299890 2025] [:error] [pid 53478:tid 53529] [client 48.210.12.181:46016] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dejavu.php"] [unique_id "aSHL4whUYdXBbQswAdQ5YwAAAFQ"]
[Sat Nov 22 22:42:43.540320 2025] [:error] [pid 53566:tid 53587] [client 48.210.12.181:45958] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dejavu.php"] [unique_id "aSHL48bSHDBkRbwMbd5xbwAAANM"]
[Sat Nov 22 22:42:43.773273 2025] [:error] [pid 53566:tid 53568] [client 48.210.12.181:45890] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dejavu.php"] [unique_id "aSHL48bSHDBkRbwMbd5xcAAAAMA"]
[Sat Nov 22 22:42:44.036310 2025] [:error] [pid 9547:tid 9570] [client 48.210.12.181:46068] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/config.php"] [unique_id "aSHL5NClOR5qk7DoMeEPTwAAAVE"]
[Sat Nov 22 22:42:44.271170 2025] [:error] [pid 25856:tid 25860] [client 48.210.12.181:46009] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/config.php"] [unique_id "aSHL5BsTP0wy94zKUvEDZQAAAQI"]
[Sat Nov 22 22:42:44.567855 2025] [:error] [pid 44259:tid 44281] [client 48.210.12.181:45955] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/config.php"] [unique_id "aSHL5HXe1xL-_YOdRmTnOQAAAZM"]
[Sat Nov 22 22:42:44.798219 2025] [:error] [pid 53566:tid 53586] [client 48.210.12.181:45975] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/config.php"] [unique_id "aSHL5MbSHDBkRbwMbd5xcQAAANI"]
[Sat Nov 22 22:42:45.034737 2025] [:error] [pid 53479:tid 53541] [client 48.210.12.181:46047] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSHL5W6cicFF3Aas-oTeeQAAAIU"]
[Sat Nov 22 22:42:45.304483 2025] [:error] [pid 53478:tid 53525] [client 48.210.12.181:45904] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSHL5QhUYdXBbQswAdQ5ZgAAAFA"]
[Sat Nov 22 22:42:45.540755 2025] [:error] [pid 53478:tid 53513] [client 48.210.12.181:46044] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSHL5QhUYdXBbQswAdQ5ZwAAAEQ"]
[Sat Nov 22 22:42:45.776525 2025] [:error] [pid 53566:tid 53576] [client 48.210.12.181:45959] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSHL5cbSHDBkRbwMbd5xcwAAAMg"]
[Sat Nov 22 22:42:46.033977 2025] [:error] [pid 53478:tid 53531] [client 48.210.12.181:46012] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSHL5ghUYdXBbQswAdQ5agAAAFY"]
[Sat Nov 22 22:42:46.263685 2025] [:error] [pid 25856:tid 25876] [client 48.210.12.181:46030] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSHL5hsTP0wy94zKUvEDaQAAARI"]
[Sat Nov 22 22:42:46.509775 2025] [:error] [pid 44259:tid 44286] [client 48.210.12.181:46053] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSHL5nXe1xL-_YOdRmTnPQAAAZg"]
[Sat Nov 22 22:42:46.738064 2025] [:error] [pid 53478:tid 53526] [client 48.210.12.181:45991] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSHL5ghUYdXBbQswAdQ5bQAAAFE"]
[Sat Nov 22 22:42:46.974729 2025] [:error] [pid 53566:tid 53591] [client 48.210.12.181:45988] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past.php"] [unique_id "aSHL5sbSHDBkRbwMbd5xdAAAANc"]
[Sat Nov 22 22:42:47.222978 2025] [:error] [pid 25856:tid 25879] [client 48.210.12.181:45968] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past.php"] [unique_id "aSHL5xsTP0wy94zKUvEDbAAAARU"]
[Sat Nov 22 22:42:47.465195 2025] [:error] [pid 25856:tid 25881] [client 48.210.12.181:45996] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past.php"] [unique_id "aSHL5xsTP0wy94zKUvEDbgAAARc"]
[Sat Nov 22 22:42:47.734565 2025] [:error] [pid 25856:tid 25860] [client 48.210.12.181:45973] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past.php"] [unique_id "aSHL5xsTP0wy94zKUvEDcQAAAQI"]
[Sat Nov 22 22:42:47.988976 2025] [:error] [pid 44259:tid 44283] [client 48.210.12.181:45826] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aSHL53Xe1xL-_YOdRmTnPgAAAZU"]
[Sat Nov 22 22:42:48.250842 2025] [:error] [pid 25856:tid 25864] [client 48.210.12.181:45891] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aSHL6BsTP0wy94zKUvEDcgAAAQY"]
[Sat Nov 22 22:42:48.485152 2025] [:error] [pid 25856:tid 25862] [client 48.210.12.181:46078] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aSHL6BsTP0wy94zKUvEDcwAAAQQ"]
[Sat Nov 22 22:42:48.726640 2025] [:error] [pid 53478:tid 53514] [client 48.210.12.181:46061] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "aSHL6AhUYdXBbQswAdQ5cQAAAEU"]
[Sat Nov 22 22:42:48.962378 2025] [:error] [pid 53478:tid 53522] [client 48.210.12.181:46067] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aSHL6AhUYdXBbQswAdQ5cgAAAE0"]
[Sat Nov 22 22:42:49.210839 2025] [:error] [pid 25856:tid 25870] [client 48.210.12.181:45954] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aSHL6RsTP0wy94zKUvEDdAAAAQw"]
[Sat Nov 22 22:42:49.455243 2025] [:error] [pid 53478:tid 53510] [client 48.210.12.181:46065] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aSHL6QhUYdXBbQswAdQ5cwAAAEE"]
[Sat Nov 22 22:42:49.688883 2025] [:error] [pid 53478:tid 53519] [client 48.210.12.181:46010] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aSHL6QhUYdXBbQswAdQ5dQAAAEo"]
[Sat Nov 22 22:42:49.930133 2025] [:error] [pid 44259:tid 44264] [client 48.210.12.181:45992] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "aSHL6XXe1xL-_YOdRmTnQQAAAYI"]
[Sat Nov 22 22:42:50.157855 2025] [:error] [pid 44259:tid 44274] [client 48.210.12.181:46000] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "aSHL6nXe1xL-_YOdRmTnQgAAAYw"]
[Sat Nov 22 22:42:50.409039 2025] [:error] [pid 9547:tid 9566] [client 48.210.12.181:45876] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "aSHL6tClOR5qk7DoMeEPVwAAAU0"]
[Sat Nov 22 22:42:50.635688 2025] [:error] [pid 9547:tid 9576] [client 48.210.12.181:46034] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "aSHL6tClOR5qk7DoMeEPWQAAAVc"]
[Sat Nov 22 22:42:50.871911 2025] [:error] [pid 53477:tid 53488] [client 48.210.12.181:46015] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSHL6n7Lu30Ku9O40aL_0gAAAAc"]
[Sat Nov 22 22:42:51.105733 2025] [:error] [pid 25856:tid 25858] [client 48.210.12.181:45977] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSHL6xsTP0wy94zKUvEDdQAAAQA"]
[Sat Nov 22 22:42:51.345512 2025] [:error] [pid 53477:tid 53504] [client 48.210.12.181:45899] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSHL637Lu30Ku9O40aL_1QAAABc"]
[Sat Nov 22 22:42:51.617569 2025] [:error] [pid 25856:tid 25859] [client 48.210.12.181:45982] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSHL6xsTP0wy94zKUvEDdwAAAQE"]
[Sat Nov 22 22:42:51.844923 2025] [:error] [pid 53479:tid 53536] [client 48.210.12.181:45902] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aSHL626cicFF3Aas-oTefwAAAIA"]
[Sat Nov 22 22:42:52.077797 2025] [:error] [pid 53477:tid 53484] [client 48.210.12.181:45895] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aSHL7H7Lu30Ku9O40aL_2AAAAAM"]
[Sat Nov 22 22:42:52.352316 2025] [:error] [pid 53477:tid 53485] [client 48.210.12.181:45986] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aSHL7H7Lu30Ku9O40aL_2gAAAAQ"]
[Sat Nov 22 22:42:52.587014 2025] [:error] [pid 9547:tid 9574] [client 48.210.12.181:46006] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aSHL7NClOR5qk7DoMeEPXQAAAVU"]
[Sat Nov 22 22:42:52.822509 2025] [:error] [pid 53477:tid 53481] [client 48.210.12.181:45897] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aSHL7H7Lu30Ku9O40aL_2wAAAAA"]
[Sat Nov 22 22:42:53.105997 2025] [:error] [pid 9547:tid 9558] [client 48.210.12.181:45920] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aSHL7dClOR5qk7DoMeEPXgAAAUU"]
[Sat Nov 22 22:42:53.344023 2025] [:error] [pid 44259:tid 44276] [client 48.210.12.181:45978] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aSHL7XXe1xL-_YOdRmTnRAAAAY4"]
[Sat Nov 22 22:42:53.583102 2025] [:error] [pid 9547:tid 9571] [client 48.210.12.181:45901] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/build.php"] [unique_id "aSHL7dClOR5qk7DoMeEPXwAAAVI"]
[Sat Nov 22 22:42:53.817268 2025] [:error] [pid 53477:tid 53501] [client 48.210.12.181:46024] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "aSHL7X7Lu30Ku9O40aL_3gAAABQ"]
[Sat Nov 22 22:42:54.066734 2025] [:error] [pid 44259:tid 44281] [client 48.210.12.181:45889] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "aSHL7nXe1xL-_YOdRmTnRgAAAZM"]
[Sat Nov 22 22:42:54.302566 2025] [:error] [pid 44259:tid 44266] [client 48.210.12.181:45900] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "aSHL7nXe1xL-_YOdRmTnRwAAAYQ"]
[Sat Nov 22 22:42:54.648887 2025] [:error] [pid 53566:tid 53575] [client 48.210.12.181:46040] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "aSHL7sbSHDBkRbwMbd5xfQAAAMc"]
[Sat Nov 22 22:42:54.905815 2025] [:error] [pid 53479:tid 53537] [client 48.210.12.181:46041] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lc.php"] [unique_id "aSHL7m6cicFF3Aas-oTegQAAAIE"]
[Sat Nov 22 22:42:55.301416 2025] [:error] [pid 44259:tid 44262] [client 48.210.12.181:46054] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lc.php"] [unique_id "aSHL73Xe1xL-_YOdRmTnSQAAAYA"]
[Sat Nov 22 22:42:55.634351 2025] [:error] [pid 53479:tid 53548] [client 48.210.12.181:45933] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lc.php"] [unique_id "aSHL726cicFF3Aas-oTegwAAAIw"]
[Sat Nov 22 22:42:55.987750 2025] [:error] [pid 53479:tid 53549] [client 48.210.12.181:45915] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lc.php"] [unique_id "aSHL726cicFF3Aas-oTehAAAAI0"]
[Sat Nov 22 22:42:56.347212 2025] [:error] [pid 44259:tid 44271] [client 48.210.12.181:46050] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cool.php"] [unique_id "aSHL8HXe1xL-_YOdRmTnSgAAAYk"]
[Sat Nov 22 22:42:56.669127 2025] [:error] [pid 53479:tid 53552] [client 48.210.12.181:45943] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cool.php"] [unique_id "aSHL8G6cicFF3Aas-oTehQAAAJA"]
[Sat Nov 22 22:42:56.942990 2025] [:error] [pid 9547:tid 9567] [client 48.210.12.181:45950] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cool.php"] [unique_id "aSHL8NClOR5qk7DoMeEPZAAAAU4"]
[Sat Nov 22 22:42:57.206526 2025] [:error] [pid 9547:tid 9561] [client 48.210.12.181:45990] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cool.php"] [unique_id "aSHL8dClOR5qk7DoMeEPZgAAAUg"]
[Sat Nov 22 22:42:57.506501 2025] [:error] [pid 53479:tid 53544] [client 48.210.12.181:45979] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSHL8W6cicFF3Aas-oTehwAAAIg"]
[Sat Nov 22 22:42:57.835613 2025] [:error] [pid 44259:tid 44268] [client 48.210.12.181:45962] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSHL8XXe1xL-_YOdRmTnTgAAAYY"]
[Sat Nov 22 22:42:58.123009 2025] [:error] [pid 44259:tid 44274] [client 48.210.12.181:45874] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSHL8nXe1xL-_YOdRmTnUAAAAYw"]
[Sat Nov 22 22:42:58.360181 2025] [:error] [pid 44259:tid 44265] [client 48.210.12.181:46066] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSHL8nXe1xL-_YOdRmTnUgAAAYM"]
[Sat Nov 22 22:42:58.644653 2025] [:error] [pid 44259:tid 44276] [client 48.210.12.181:45913] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSHL8nXe1xL-_YOdRmTnVAAAAY4"]
[Sat Nov 22 22:42:58.907367 2025] [:error] [pid 44259:tid 44266] [client 48.210.12.181:45999] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSHL8nXe1xL-_YOdRmTnVgAAAYQ"]
[Sat Nov 22 22:42:59.142037 2025] [:error] [pid 53566:tid 53579] [client 48.210.12.181:46002] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSHL88bSHDBkRbwMbd5xfgAAAMs"]
[Sat Nov 22 22:42:59.530831 2025] [:error] [pid 44259:tid 44280] [client 48.210.12.181:45930] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSHL83Xe1xL-_YOdRmTnWgAAAZI"]
[Sat Nov 22 22:42:59.800800 2025] [:error] [pid 53479:tid 53546] [client 48.210.12.181:46011] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfile.php"] [unique_id "aSHL826cicFF3Aas-oTeiAAAAIo"]
[Sat Nov 22 22:43:00.052975 2025] [:error] [pid 53478:tid 53528] [client 48.210.12.181:45928] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfile.php"] [unique_id "aSHL9AhUYdXBbQswAdQ5iwAAAFM"]
[Sat Nov 22 22:43:00.306907 2025] [:error] [pid 53479:tid 53559] [client 48.210.12.181:46049] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfile.php"] [unique_id "aSHL9G6cicFF3Aas-oTeiQAAAJc"]
[Sat Nov 22 22:43:00.572953 2025] [:error] [pid 53477:tid 53488] [client 48.210.12.181:46066] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfile.php"] [unique_id "aSHL9H7Lu30Ku9O40aL_4AAAAAc"]
[Sat Nov 22 22:43:00.809193 2025] [:error] [pid 53477:tid 53500] [client 48.210.12.181:46013] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "aSHL9H7Lu30Ku9O40aL_4QAAABM"]
[Sat Nov 22 22:43:01.052274 2025] [:error] [pid 25856:tid 25863] [client 48.210.12.181:45931] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "aSHL9RsTP0wy94zKUvEDfgAAAQU"]
[Sat Nov 22 22:43:01.280173 2025] [:error] [pid 53566:tid 53581] [client 48.210.12.181:45922] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "aSHL9cbSHDBkRbwMbd5xfwAAAM0"]
[Sat Nov 22 22:43:01.523082 2025] [:error] [pid 53477:tid 53491] [client 48.210.12.181:45934] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "aSHL9X7Lu30Ku9O40aL_4wAAAAo"]
[Sat Nov 22 22:43:01.767537 2025] [:error] [pid 53478:tid 53512] [client 48.210.12.181:46014] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "aSHL9QhUYdXBbQswAdQ5jgAAAEM"]
[Sat Nov 22 22:43:02.011634 2025] [:error] [pid 53479:tid 53542] [client 48.210.12.181:45866] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "aSHL9m6cicFF3Aas-oTeiwAAAIY"]
[Sat Nov 22 22:43:02.300557 2025] [:error] [pid 44259:tid 44263] [client 48.210.12.181:45910] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "aSHL9nXe1xL-_YOdRmTnYQAAAYE"]
[Sat Nov 22 22:43:02.542154 2025] [:error] [pid 53477:tid 53492] [client 48.210.12.181:45844] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "aSHL9n7Lu30Ku9O40aL_5gAAAAs"]
[Sat Nov 22 22:43:02.789426 2025] [:error] [pid 53566:tid 53587] [client 48.210.12.181:45967] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/num.php"] [unique_id "aSHL9sbSHDBkRbwMbd5xgQAAANM"]
[Sat Nov 22 22:43:03.062105 2025] [:error] [pid 53477:tid 53498] [client 48.210.12.181:45906] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/num.php"] [unique_id "aSHL937Lu30Ku9O40aL_6AAAABE"]
[Sat Nov 22 22:43:03.307682 2025] [:error] [pid 53479:tid 53537] [client 48.210.12.181:45949] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/num.php"] [unique_id "aSHL926cicFF3Aas-oTejQAAAIE"]
[Sat Nov 22 22:43:03.540491 2025] [:error] [pid 53566:tid 53576] [client 48.210.12.181:45859] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/num.php"] [unique_id "aSHL98bSHDBkRbwMbd5xggAAAMg"]
[Sat Nov 22 22:43:03.838236 2025] [:error] [pid 53566:tid 53592] [client 48.210.12.181:46051] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/astab.php"] [unique_id "aSHL98bSHDBkRbwMbd5xgwAAANg"]
[Sat Nov 22 22:43:04.080363 2025] [:error] [pid 53478:tid 53522] [client 48.210.12.181:45976] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/astab.php"] [unique_id "aSHL-AhUYdXBbQswAdQ5kQAAAE0"]
[Sat Nov 22 22:43:04.321065 2025] [:error] [pid 25856:tid 25876] [client 48.210.12.181:46037] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/astab.php"] [unique_id "aSHL-BsTP0wy94zKUvEDgAAAARI"]
[Sat Nov 22 22:43:04.581049 2025] [:error] [pid 25856:tid 25881] [client 48.210.12.181:45894] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/astab.php"] [unique_id "aSHL-BsTP0wy94zKUvEDgQAAARc"]
[Sat Nov 22 22:43:04.807453 2025] [:error] [pid 25856:tid 25860] [client 48.210.12.181:45995] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "aSHL-BsTP0wy94zKUvEDggAAAQI"]
[Sat Nov 22 22:43:05.048126 2025] [:error] [pid 53479:tid 53548] [client 48.210.12.181:45925] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "aSHL-W6cicFF3Aas-oTejgAAAIw"]
[Sat Nov 22 22:43:05.305865 2025] [:error] [pid 53477:tid 53501] [client 48.210.12.181:45917] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "aSHL-X7Lu30Ku9O40aL_6QAAABQ"]
[Sat Nov 22 22:43:05.549191 2025] [:error] [pid 9547:tid 9572] [client 48.210.12.181:45972] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "aSHL-dClOR5qk7DoMeEPbAAAAVM"]
[Sat Nov 22 22:43:05.778742 2025] [:error] [pid 53478:tid 53529] [client 48.210.12.181:45840] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file17.php"] [unique_id "aSHL-QhUYdXBbQswAdQ5lQAAAFQ"]
[Sat Nov 22 22:43:06.037396 2025] [:error] [pid 44259:tid 44265] [client 48.210.12.181:45898] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file17.php"] [unique_id "aSHL-nXe1xL-_YOdRmTnZQAAAYM"]
[Sat Nov 22 22:43:06.292688 2025] [:error] [pid 53478:tid 53509] [client 48.210.12.181:46057] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file17.php"] [unique_id "aSHL-ghUYdXBbQswAdQ5lgAAAEA"]
[Sat Nov 22 22:43:06.523267 2025] [:error] [pid 53478:tid 53530] [client 48.210.12.181:45966] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file17.php"] [unique_id "aSHL-ghUYdXBbQswAdQ5mAAAAFU"]
[Sat Nov 22 22:43:06.823785 2025] [:error] [pid 53477:tid 53495] [client 48.210.12.181:45987] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pepe.php"] [unique_id "aSHL-n7Lu30Ku9O40aL_6wAAAA4"]
[Sat Nov 22 22:43:07.103724 2025] [:error] [pid 25856:tid 25882] [client 48.210.12.181:46028] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pepe.php"] [unique_id "aSHL-xsTP0wy94zKUvEDhAAAARg"]
[Sat Nov 22 22:43:07.351601 2025] [:error] [pid 53477:tid 53496] [client 48.210.12.181:45863] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pepe.php"] [unique_id "aSHL-37Lu30Ku9O40aL_7gAAAA8"]
[Sat Nov 22 22:43:07.584825 2025] [:error] [pid 53566:tid 53570] [client 48.210.12.181:46052] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pepe.php"] [unique_id "aSHL-8bSHDBkRbwMbd5xiwAAAMI"]
[Sat Nov 22 22:43:07.823454 2025] [:error] [pid 53566:tid 53575] [client 48.210.12.181:46046] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSHL-8bSHDBkRbwMbd5xjAAAAMc"]
[Sat Nov 22 22:43:08.118318 2025] [:error] [pid 44259:tid 44278] [client 48.210.12.181:45929] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSHL_HXe1xL-_YOdRmTnaAAAAZA"]
[Sat Nov 22 22:43:08.351938 2025] [:error] [pid 53566:tid 53574] [client 48.210.12.181:45860] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSHL_MbSHDBkRbwMbd5xjQAAAMY"]
[Sat Nov 22 22:43:08.599492 2025] [:error] [pid 44259:tid 44285] [client 48.210.12.181:45849] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSHL_HXe1xL-_YOdRmTnagAAAZc"]
[Sat Nov 22 22:43:08.877004 2025] [:error] [pid 53479:tid 53553] [client 48.210.12.181:45887] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-update.php"] [unique_id "aSHL_G6cicFF3Aas-oTekwAAAJE"]
[Sat Nov 22 22:43:09.173871 2025] [:error] [pid 53566:tid 53581] [client 48.210.12.181:45824] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-update.php"] [unique_id "aSHL_cbSHDBkRbwMbd5xjwAAAM0"]
[Sat Nov 22 22:43:09.414642 2025] [:error] [pid 53477:tid 53491] [client 48.210.12.181:45837] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-update.php"] [unique_id "aSHL_X7Lu30Ku9O40aL_8QAAAAo"]
[Sat Nov 22 22:43:09.655091 2025] [:error] [pid 53479:tid 53542] [client 48.210.12.181:45994] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-update.php"] [unique_id "aSHL_W6cicFF3Aas-oTelAAAAIY"]
[Sat Nov 22 22:43:09.908766 2025] [:error] [pid 44259:tid 44284] [client 48.210.12.181:45844] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless.php"] [unique_id "aSHL_XXe1xL-_YOdRmTnbQAAAZY"]
[Sat Nov 22 22:43:10.151288 2025] [:error] [pid 53478:tid 53521] [client 48.210.12.181:45935] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless.php"] [unique_id "aSHL_ghUYdXBbQswAdQ5nAAAAEw"]
[Sat Nov 22 22:43:10.420672 2025] [:error] [pid 44259:tid 44273] [client 48.210.12.181:45831] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless.php"] [unique_id "aSHL_nXe1xL-_YOdRmTncAAAAYs"]
[Sat Nov 22 22:43:10.662013 2025] [:error] [pid 25856:tid 25880] [client 48.210.12.181:45765] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless.php"] [unique_id "aSHL_hsTP0wy94zKUvEDhwAAARY"]
[Sat Nov 22 22:43:10.991874 2025] [:error] [pid 9547:tid 9571] [client 48.210.12.181:46005] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/faq.php"] [unique_id "aSHL_tClOR5qk7DoMeEPdgAAAVI"]
[Sat Nov 22 22:43:11.222802 2025] [:error] [pid 53566:tid 53587] [client 48.210.12.181:45845] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/faq.php"] [unique_id "aSHL_8bSHDBkRbwMbd5xkQAAANM"]
[Sat Nov 22 22:43:11.474518 2025] [:error] [pid 53477:tid 53502] [client 48.210.12.181:45976] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/faq.php"] [unique_id "aSHL_37Lu30Ku9O40aL_9AAAABU"]
[Sat Nov 22 22:43:11.719959 2025] [:error] [pid 53566:tid 53592] [client 48.210.12.181:45985] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/faq.php"] [unique_id "aSHL_8bSHDBkRbwMbd5xkwAAANg"]
[Sat Nov 22 22:43:11.973935 2025] [:error] [pid 53477:tid 53494] [client 48.210.12.181:45907] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aSHL_37Lu30Ku9O40aL_9gAAAA0"]
[Sat Nov 22 22:43:12.213269 2025] [:error] [pid 53566:tid 53588] [client 48.210.12.181:45851] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aSHMAMbSHDBkRbwMbd5xlQAAANQ"]
[Sat Nov 22 22:43:12.486906 2025] [:error] [pid 25856:tid 25866] [client 48.210.12.181:45875] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aSHMABsTP0wy94zKUvEDiAAAAQg"]
[Sat Nov 22 22:43:12.716261 2025] [:error] [pid 53566:tid 53591] [client 48.210.12.181:45993] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "aSHMAMbSHDBkRbwMbd5xlwAAANc"]
[Sat Nov 22 22:43:12.959257 2025] [:error] [pid 53479:tid 53537] [client 48.210.12.181:45918] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/CLA.php"] [unique_id "aSHMAG6cicFF3Aas-oTelgAAAIE"]
[Sat Nov 22 22:43:13.261876 2025] [:error] [pid 25856:tid 25864] [client 48.210.12.181:45770] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/CLA.php"] [unique_id "aSHMARsTP0wy94zKUvEDiQAAAQY"]
[Sat Nov 22 22:43:13.499687 2025] [:error] [pid 44259:tid 44272] [client 48.210.12.181:45911] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/CLA.php"] [unique_id "aSHMAXXe1xL-_YOdRmTneAAAAYo"]
[Sat Nov 22 22:43:13.742224 2025] [:error] [pid 53566:tid 53585] [client 48.210.12.181:45912] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/CLA.php"] [unique_id "aSHMAcbSHDBkRbwMbd5xmQAAANE"]
[Sat Nov 22 22:43:13.984645 2025] [:error] [pid 44259:tid 44282] [client 48.210.12.181:45969] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aSHMAXXe1xL-_YOdRmTnegAAAZQ"]
[Sat Nov 22 22:43:14.225356 2025] [:error] [pid 53566:tid 53570] [client 48.210.12.181:45832] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aSHMAsbSHDBkRbwMbd5xmwAAAMI"]
[Sat Nov 22 22:43:14.455957 2025] [:error] [pid 53566:tid 53575] [client 48.210.12.181:45919] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aSHMAsbSHDBkRbwMbd5xnAAAAMc"]
[Sat Nov 22 22:43:14.794717 2025] [:error] [pid 53566:tid 53589] [client 48.210.12.181:45989] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aSHMAsbSHDBkRbwMbd5xnQAAANU"]
[Sat Nov 22 22:43:15.054775 2025] [:error] [pid 53478:tid 53518] [client 48.210.12.181:46032] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mn.php"] [unique_id "aSHMAwhUYdXBbQswAdQ5nwAAAEk"]
[Sat Nov 22 22:43:15.289944 2025] [:error] [pid 53478:tid 53510] [client 48.210.12.181:46075] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mn.php"] [unique_id "aSHMAwhUYdXBbQswAdQ5oAAAAEE"]
[Sat Nov 22 22:43:15.606130 2025] [:error] [pid 25856:tid 25869] [client 48.210.12.181:45998] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mn.php"] [unique_id "aSHMAxsTP0wy94zKUvEDiwAAAQs"]
[Sat Nov 22 22:43:15.837442 2025] [:error] [pid 53566:tid 53577] [client 48.210.12.181:45862] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mn.php"] [unique_id "aSHMA8bSHDBkRbwMbd5xngAAAMk"]
[Sat Nov 22 22:43:16.076357 2025] [:error] [pid 44259:tid 44285] [client 48.210.12.181:46021] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ss.php"] [unique_id "aSHMBHXe1xL-_YOdRmTnewAAAZc"]
[Sat Nov 22 22:43:16.333859 2025] [:error] [pid 53478:tid 53524] [client 48.210.12.181:45838] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ss.php"] [unique_id "aSHMBAhUYdXBbQswAdQ5oQAAAE8"]
[Sat Nov 22 22:43:16.610764 2025] [:error] [pid 53477:tid 53488] [client 48.210.12.181:45948] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ss.php"] [unique_id "aSHMBH7Lu30Ku9O40aL_-gAAAAc"]
[Sat Nov 22 22:43:16.837581 2025] [:error] [pid 53478:tid 53519] [client 48.210.12.181:45869] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ss.php"] [unique_id "aSHMBAhUYdXBbQswAdQ5ogAAAEo"]
[Sat Nov 22 22:43:17.090738 2025] [:error] [pid 44259:tid 44273] [client 48.210.12.181:45764] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-logiin.php"] [unique_id "aSHMBXXe1xL-_YOdRmTnfAAAAYs"]
[Sat Nov 22 22:43:17.339884 2025] [:error] [pid 53479:tid 53549] [client 48.210.12.181:45939] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-logiin.php"] [unique_id "aSHMBW6cicFF3Aas-oTemgAAAI0"]
[Sat Nov 22 22:43:17.573758 2025] [:error] [pid 53479:tid 53552] [client 48.210.12.181:45883] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-logiin.php"] [unique_id "aSHMBW6cicFF3Aas-oTemwAAAJA"]
[Sat Nov 22 22:43:17.829142 2025] [:error] [pid 25856:tid 25859] [client 48.210.12.181:45936] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-logiin.php"] [unique_id "aSHMBRsTP0wy94zKUvEDjwAAAQE"]
[Sun Nov 23 05:16:38.785343 2025] [:error] [pid 38739:tid 38784] [client 216.126.225.91:37282] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aSIoNgdvEgJm2n2cDmr7UwAAAE8"]
[Sun Nov 23 08:38:50.933380 2025] [:error] [pid 38740:tid 38813] [client 125.94.144.102:50111] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSJXmg13QPZSi6O8umXXEAAAAJE"]
[Sun Nov 23 16:46:31.590402 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.42:43743] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSLJ508WZjXLvbHTHPfDmQAAAMA"]
[Sun Nov 23 16:46:32.592469 2025] [:error] [pid 14602:tid 14639] [client 140.99.1.48:50547] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSLJ6B-I77jdD81pU-mnwgAAAVI"]
[Sun Nov 23 16:46:34.086914 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.68:38803] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aSLJ6k8WZjXLvbHTHPfD0QAAAMA"]
[Sun Nov 23 16:46:34.849833 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.6:49875] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "aSLJ6gdvEgJm2n2cDmo6QAAAAEo"]
[Sun Nov 23 16:46:53.625681 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.68:54859] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSLJ_U8WZjXLvbHTHPfFFwAAAMM"]
[Sun Nov 23 17:36:23.153774 2025] [:error] [pid 16066:tid 16084] [client 176.65.132.18:36518] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aSLVl_q-c47Q5mW5E9GdSgAAAY8"]
[Sun Nov 23 21:31:31.393800 2025] [:error] [pid 44652:tid 44715] [client 182.44.2.148:54394] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSMMs9iQFwsyXQDhwyAkxQAAAQk"]
[Mon Nov 24 01:52:31.738417 2025] [:error] [pid 1452:tid 1468] [client 176.65.132.18:56158] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aSNJ3xKZkEEyVNVXr_nMygAAAEs"]
[Mon Nov 24 04:48:41.191056 2025] [:error] [pid 12999:tid 13012] [client 52.236.123.156:39962] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/marijuana.php"] [unique_id "aSNzKVtj_teEYJ8vu7H-oQAAAMk"]
[Mon Nov 24 04:48:44.055492 2025] [:error] [pid 12912:tid 12982] [client 52.236.123.156:39965] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/marijuana.php"] [unique_id "aSNzLJMj_Lgt36UonYKu2wAAAI0"]
[Mon Nov 24 04:48:47.564404 2025] [:error] [pid 12911:tid 12946] [client 52.236.123.156:39974] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/marijuana.php"] [unique_id "aSNzL0DMbk9464jnIl7a3gAAAEQ"]
[Mon Nov 24 04:48:49.972452 2025] [:error] [pid 12911:tid 12942] [client 52.236.123.156:39982] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/marijuana.php"] [unique_id "aSNzMUDMbk9464jnIl7a4AAAAEA"]
[Mon Nov 24 04:48:51.698379 2025] [:error] [pid 12999:tid 13019] [client 52.236.123.156:40075] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSNzM1tj_teEYJ8vu7H-rwAAANA"]
[Mon Nov 24 04:48:53.408727 2025] [:error] [pid 12912:tid 12990] [client 52.236.123.156:40084] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSNzNZMj_Lgt36UonYKu7gAAAJU"]
[Mon Nov 24 04:49:14.238693 2025] [:error] [pid 12910:tid 12927] [client 52.236.123.156:39964] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSNzSmkWgvzAF2Nei2VibwAAAAw"]
[Mon Nov 24 04:49:15.646830 2025] [:error] [pid 12910:tid 12920] [client 52.236.123.156:40073] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSNzS2kWgvzAF2Nei2VicQAAAAU"]
[Mon Nov 24 04:49:18.217220 2025] [:error] [pid 12912:tid 12970] [client 52.236.123.156:39951] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSNzTpMj_Lgt36UonYKvEAAAAIE"]
[Mon Nov 24 04:49:22.759413 2025] [:error] [pid 12999:tid 13007] [client 52.236.123.156:39956] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSNzUltj_teEYJ8vu7H-yQAAAMQ"]
[Mon Nov 24 04:49:54.078042 2025] [:error] [pid 12910:tid 12921] [client 52.236.123.156:40093] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSNzcmkWgvzAF2Nei2ViqwAAAAY"]
[Mon Nov 24 04:49:58.000307 2025] [:error] [pid 12912:tid 12972] [client 52.236.123.156:40096] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSNzdZMj_Lgt36UonYKvSAAAAIM"]
[Mon Nov 24 04:50:06.210685 2025] [:error] [pid 12999:tid 13014] [client 52.236.123.156:39939] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSNzfltj_teEYJ8vu7H_FwAAAMs"]
[Mon Nov 24 04:50:10.428521 2025] [:error] [pid 12911:tid 12957] [client 52.236.123.156:39942] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSNzgkDMbk9464jnIl7bLQAAAE8"]
[Mon Nov 24 04:50:13.409782 2025] [:error] [pid 12999:tid 13017] [client 52.236.123.156:39980] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSNzhVtj_teEYJ8vu7H_JQAAAM4"]
[Mon Nov 24 04:50:15.480324 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:40124] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSNzh1tj_teEYJ8vu7H_KwAAAMo"]
[Mon Nov 24 04:50:18.136817 2025] [:error] [pid 12910:tid 12939] [client 52.236.123.156:40064] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "aSNzimkWgvzAF2Nei2ViwgAAABg"]
[Mon Nov 24 04:50:22.010110 2025] [:error] [pid 12999:tid 13021] [client 52.236.123.156:40082] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSNzjltj_teEYJ8vu7H_OQAAANI"]
[Mon Nov 24 04:50:23.140646 2025] [:error] [pid 12999:tid 13004] [client 52.236.123.156:40079] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSNzj1tj_teEYJ8vu7H_RAAAAME"]
[Mon Nov 24 04:50:24.556812 2025] [:error] [pid 12999:tid 13022] [client 52.236.123.156:40103] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSNzkFtj_teEYJ8vu7H_VwAAANM"]
[Mon Nov 24 04:50:48.946892 2025] [:error] [pid 12911:tid 12951] [client 43.132.214.228:39394] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSNzqEDMbk9464jnIl7bagAAAEk"]
[Mon Nov 24 04:51:16.444517 2025] [:error] [pid 12999:tid 13010] [client 52.236.123.156:40081] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSNzxFtj_teEYJ8vu7H_nAAAAMc"]
[Mon Nov 24 04:51:29.287225 2025] [:error] [pid 12999:tid 13014] [client 52.236.123.156:40077] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNz0Vtj_teEYJ8vu7H_rwAAAMs"]
[Mon Nov 24 04:51:31.538136 2025] [:error] [pid 12911:tid 12947] [client 52.236.123.156:39940] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNz00DMbk9464jnIl7btwAAAEU"]
[Mon Nov 24 04:51:34.806243 2025] [:error] [pid 12912:tid 12989] [client 52.236.123.156:40120] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/0.php"] [unique_id "aSNz1pMj_Lgt36UonYKvngAAAJQ"]
[Mon Nov 24 04:51:38.252093 2025] [:error] [pid 12911:tid 12955] [client 52.236.123.156:40125] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz2kDMbk9464jnIl7byAAAAE0"]
[Mon Nov 24 04:51:40.245048 2025] [:error] [pid 12910:tid 12927] [client 52.236.123.156:40078] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz3GkWgvzAF2Nei2VjXgAAAAw"]
[Mon Nov 24 04:51:44.179925 2025] [:error] [pid 12911:tid 12959] [client 52.236.123.156:40080] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz4EDMbk9464jnIl7b2QAAAFE"]
[Mon Nov 24 04:51:46.371047 2025] [:error] [pid 12910:tid 12918] [client 52.236.123.156:39938] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz4mkWgvzAF2Nei2VjdgAAAAM"]
[Mon Nov 24 04:51:48.862012 2025] [:error] [pid 12999:tid 13008] [client 52.236.123.156:39975] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSNz5Ftj_teEYJ8vu7H_0AAAAMU"]
[Mon Nov 24 04:51:50.402227 2025] [:error] [pid 12999:tid 13015] [client 52.236.123.156:39955] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSNz5ltj_teEYJ8vu7H_0gAAAMw"]
[Mon Nov 24 04:51:56.052141 2025] [:error] [pid 12910:tid 12939] [client 52.236.123.156:40126] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSNz7GkWgvzAF2Nei2VjjgAAABg"]
[Mon Nov 24 04:51:58.721968 2025] [:error] [pid 12912:tid 12972] [client 52.236.123.156:40087] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSNz7pMj_Lgt36UonYKvvQAAAIM"]
[Mon Nov 24 04:52:01.647899 2025] [:error] [pid 12999:tid 13009] [client 52.236.123.156:40102] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSNz8Vtj_teEYJ8vu7H_6AAAAMY"]
[Mon Nov 24 04:52:06.587096 2025] [:error] [pid 12912:tid 12981] [client 52.236.123.156:39952] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/i1.php"] [unique_id "aSNz9pMj_Lgt36UonYKvwQAAAIw"]
[Mon Nov 24 04:52:30.464345 2025] [:error] [pid 12912:tid 12986] [client 52.236.123.156:39984] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/17.php"] [unique_id "aSN0DpMj_Lgt36UonYKv5wAAAJE"]
[Mon Nov 24 04:52:32.386486 2025] [:error] [pid 12999:tid 13009] [client 52.236.123.156:40076] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/17.php"] [unique_id "aSN0EFtj_teEYJ8vu7EAMwAAAMY"]
[Mon Nov 24 04:52:35.573464 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:56333] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/17.php"] [unique_id "aSN0E1tj_teEYJ8vu7EAOAAAAMo"]
[Mon Nov 24 04:52:39.266655 2025] [:error] [pid 12999:tid 13007] [client 52.236.123.156:40604] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/17.php"] [unique_id "aSN0F1tj_teEYJ8vu7EAQgAAAMQ"]
[Mon Nov 24 04:52:44.513524 2025] [:error] [pid 12911:tid 12961] [client 52.236.123.156:40118] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "aSN0HEDMbk9464jnIl7cUQAAAFM"]
[Mon Nov 24 04:52:48.248723 2025] [:error] [pid 12910:tid 12932] [client 52.236.123.156:39936] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "aSN0IGkWgvzAF2Nei2VjzwAAABE"]
[Mon Nov 24 04:52:51.409126 2025] [:error] [pid 12912:tid 12973] [client 52.236.123.156:56369] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "aSN0I5Mj_Lgt36UonYKwBwAAAIQ"]
[Mon Nov 24 04:53:05.332929 2025] [:error] [pid 12999:tid 13009] [client 52.236.123.156:40127] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0MVtj_teEYJ8vu7EAVQAAAMY"]
[Mon Nov 24 04:53:08.254714 2025] [:error] [pid 12912:tid 12987] [client 52.236.123.156:39971] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0NJMj_Lgt36UonYKwFwAAAJI"]
[Mon Nov 24 04:53:11.229684 2025] [:error] [pid 12911:tid 12952] [client 52.236.123.156:40116] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0N0DMbk9464jnIl7cagAAAEo"]
[Mon Nov 24 04:53:14.618379 2025] [:error] [pid 12999:tid 13004] [client 52.236.123.156:40117] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0Oltj_teEYJ8vu7EAWgAAAME"]
[Mon Nov 24 04:53:27.286130 2025] [:error] [pid 12912:tid 12983] [client 52.236.123.156:39972] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-configs.php"] [unique_id "aSN0R5Mj_Lgt36UonYKwMwAAAI4"]
[Mon Nov 24 04:53:30.247763 2025] [:error] [pid 12911:tid 12966] [client 52.236.123.156:40105] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSN0SkDMbk9464jnIl7cigAAAFg"]
[Mon Nov 24 04:53:48.448186 2025] [:error] [pid 12912:tid 12992] [client 52.236.123.156:39964] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "aSN0XJMj_Lgt36UonYKwVQAAAJc"]
[Mon Nov 24 04:53:49.879877 2025] [:error] [pid 12912:tid 12981] [client 52.236.123.156:40109] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "aSN0XZMj_Lgt36UonYKwWQAAAIw"]
[Mon Nov 24 04:53:52.340780 2025] [:error] [pid 12912:tid 12973] [client 52.236.123.156:40113] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "aSN0YJMj_Lgt36UonYKwYQAAAIQ"]
[Mon Nov 24 04:54:00.467889 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:39941] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "aSN0aFtj_teEYJ8vu7EAmgAAAMo"]
[Mon Nov 24 04:54:03.426762 2025] [:error] [pid 12999:tid 13020] [client 52.236.123.156:40068] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/Marvins.php"] [unique_id "aSN0a1tj_teEYJ8vu7EApQAAANE"]
[Mon Nov 24 04:54:08.873771 2025] [:error] [pid 12912:tid 12978] [client 52.236.123.156:39993] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/Marvins.php"] [unique_id "aSN0cJMj_Lgt36UonYKwhgAAAIk"]
[Mon Nov 24 04:54:12.359683 2025] [:error] [pid 12911:tid 12953] [client 52.236.123.156:40084] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/Marvins.php"] [unique_id "aSN0dEDMbk9464jnIl7coAAAAEs"]
[Mon Nov 24 04:54:17.227627 2025] [:error] [pid 12912:tid 12986] [client 52.236.123.156:40069] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSN0eZMj_Lgt36UonYKwmAAAAJE"]
[Mon Nov 24 04:54:25.778709 2025] [:error] [pid 12911:tid 12963] [client 52.236.123.156:39956] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSN0gUDMbk9464jnIl7crAAAAFU"]
[Mon Nov 24 04:54:28.651096 2025] [:error] [pid 12910:tid 12925] [client 52.236.123.156:40107] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSN0hGkWgvzAF2Nei2VkGQAAAAo"]
[Mon Nov 24 04:54:36.026111 2025] [:error] [pid 12911:tid 12965] [client 52.236.123.156:56357] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/124.php"] [unique_id "aSN0jEDMbk9464jnIl7cuAAAAFc"]
[Mon Nov 24 04:55:32.547000 2025] [:error] [pid 12999:tid 13008] [client 52.236.123.156:56326] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/123.php"] [unique_id "aSN0xFtj_teEYJ8vu7EBMQAAAMU"]
[Mon Nov 24 04:55:37.766353 2025] [:error] [pid 12999:tid 13007] [client 52.236.123.156:39981] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/123.php"] [unique_id "aSN0yVtj_teEYJ8vu7EBNwAAAMQ"]
[Mon Nov 24 04:55:40.309754 2025] [:error] [pid 12911:tid 12962] [client 52.236.123.156:40618] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/123.php"] [unique_id "aSN0zEDMbk9464jnIl7dSwAAAFQ"]
[Mon Nov 24 04:55:47.668156 2025] [:error] [pid 12910:tid 12937] [client 52.236.123.156:40090] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSN002kWgvzAF2Nei2VkYgAAABY"]
[Mon Nov 24 04:55:49.498256 2025] [:error] [pid 12999:tid 13025] [client 52.236.123.156:40124] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSN01Vtj_teEYJ8vu7EBZQAAANY"]
[Mon Nov 24 04:55:51.209011 2025] [:error] [pid 12912:tid 12979] [client 52.236.123.156:56364] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSN015Mj_Lgt36UonYKxIwAAAIo"]
[Mon Nov 24 04:55:52.669456 2025] [:error] [pid 12910:tid 12922] [client 52.236.123.156:40071] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSN02GkWgvzAF2Nei2VkaQAAAAc"]
[Mon Nov 24 04:55:58.167760 2025] [:error] [pid 12912:tid 12969] [client 52.236.123.156:39946] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSN03pMj_Lgt36UonYKxLQAAAIA"]
[Mon Nov 24 04:56:00.665158 2025] [:error] [pid 12912:tid 12970] [client 52.236.123.156:39943] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSN04JMj_Lgt36UonYKxMgAAAIE"]
[Mon Nov 24 04:56:02.989499 2025] [:error] [pid 12912:tid 12975] [client 52.236.123.156:39979] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "aSN04pMj_Lgt36UonYKxNQAAAIY"]
[Mon Nov 24 04:56:09.297113 2025] [:error] [pid 12999:tid 13006] [client 52.236.123.156:40093] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uploads/multi.php"] [unique_id "aSN06Vtj_teEYJ8vu7EBegAAAMM"]
[Mon Nov 24 04:56:10.713971 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:40119] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uploads/multi.php"] [unique_id "aSN06ltj_teEYJ8vu7EBfAAAAMo"]
[Mon Nov 24 04:56:47.584438 2025] [:error] [pid 12910:tid 12926] [client 52.236.123.156:40083] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/403.php"] [unique_id "aSN1D2kWgvzAF2Nei2VktQAAAAs"]
[Mon Nov 24 04:56:54.780407 2025] [:error] [pid 12912:tid 12980] [client 52.236.123.156:40111] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/403.php"] [unique_id "aSN1FpMj_Lgt36UonYKxkAAAAIs"]
[Mon Nov 24 04:56:57.563009 2025] [:error] [pid 12999:tid 13009] [client 52.236.123.156:56373] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/403.php"] [unique_id "aSN1GVtj_teEYJ8vu7EB8AAAAMY"]
[Mon Nov 24 04:57:04.855237 2025] [:error] [pid 12999:tid 13023] [client 52.236.123.156:56339] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1IFtj_teEYJ8vu7EB9wAAANQ"]
[Mon Nov 24 04:57:07.270018 2025] [:error] [pid 12910:tid 12921] [client 52.236.123.156:39990] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1I2kWgvzAF2Nei2Vk2QAAAAY"]
[Mon Nov 24 04:57:15.789560 2025] [:error] [pid 12999:tid 13023] [client 52.236.123.156:39984] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1K1tj_teEYJ8vu7ECFAAAANQ"]
[Mon Nov 24 04:57:19.406276 2025] [:error] [pid 12911:tid 12943] [client 52.236.123.156:56332] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1L0DMbk9464jnIl7d5wAAAEE"]
[Mon Nov 24 04:57:24.811941 2025] [:error] [pid 12912:tid 12979] [client 52.236.123.156:40064] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aSN1NJMj_Lgt36UonYKxvQAAAIo"]
[Mon Nov 24 04:57:28.010886 2025] [:error] [pid 12912:tid 12985] [client 52.236.123.156:40095] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aSN1OJMj_Lgt36UonYKxvgAAAJA"]
[Mon Nov 24 04:57:36.228499 2025] [:error] [pid 12999:tid 13005] [client 52.236.123.156:39940] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/up.php"] [unique_id "aSN1QFtj_teEYJ8vu7ECNAAAAMI"]
[Mon Nov 24 04:58:09.190443 2025] [:error] [pid 12912:tid 12988] [client 52.236.123.156:40101] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSN1YZMj_Lgt36UonYKx4AAAAJM"]
[Mon Nov 24 04:58:17.508067 2025] [:error] [pid 12912:tid 12978] [client 52.236.123.156:39989] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aSN1aZMj_Lgt36UonYKx5gAAAIk"]
[Mon Nov 24 04:58:31.576114 2025] [:error] [pid 12910:tid 12926] [client 52.236.123.156:56356] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ee.php"] [unique_id "aSN1d2kWgvzAF2Nei2VlNgAAAAs"]
[Mon Nov 24 04:58:37.952637 2025] [:error] [pid 12912:tid 12993] [client 52.236.123.156:39938] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSN1fZMj_Lgt36UonYKx_AAAAJg"]
[Mon Nov 24 04:58:40.275033 2025] [:error] [pid 12911:tid 12959] [client 52.236.123.156:40068] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSN1gEDMbk9464jnIl7eDQAAAFE"]
[Mon Nov 24 04:58:42.363029 2025] [:error] [pid 12912:tid 12982] [client 52.236.123.156:40088] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSN1gpMj_Lgt36UonYKyAwAAAI0"]
[Mon Nov 24 04:58:44.298882 2025] [:error] [pid 12910:tid 12939] [client 52.236.123.156:40100] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSN1hGkWgvzAF2Nei2VlQQAAABg"]
[Mon Nov 24 04:58:47.273982 2025] [:error] [pid 12910:tid 12915] [client 52.236.123.156:39974] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wi.php"] [unique_id "aSN1h2kWgvzAF2Nei2VlRQAAAAA"]
[Mon Nov 24 04:59:24.295003 2025] [:error] [pid 12911:tid 12952] [client 52.236.123.156:39995] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSN1rEDMbk9464jnIl7eMQAAAEo"]
[Mon Nov 24 04:59:42.609906 2025] [:error] [pid 12912:tid 12990] [client 52.236.123.156:39941] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aSN1vpMj_Lgt36UonYKyMgAAAJU"]
[Mon Nov 24 04:59:44.717203 2025] [:error] [pid 12910:tid 12939] [client 52.236.123.156:40620] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aSN1wGkWgvzAF2Nei2VlpgAAABg"]
[Mon Nov 24 04:59:46.270410 2025] [:error] [pid 12999:tid 13008] [client 52.236.123.156:39964] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aSN1wltj_teEYJ8vu7EC3wAAAMU"]
[Mon Nov 24 04:59:47.362936 2025] [:error] [pid 12911:tid 12944] [client 52.236.123.156:39985] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "aSN1w0DMbk9464jnIl7eUAAAAEI"]
[Mon Nov 24 04:59:48.926586 2025] [:error] [pid 12910:tid 12920] [client 52.236.123.156:40126] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSN1xGkWgvzAF2Nei2VlqwAAAAU"]
[Mon Nov 24 04:59:52.022251 2025] [:error] [pid 12911:tid 12963] [client 52.236.123.156:56363] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/po.php"] [unique_id "aSN1yEDMbk9464jnIl7eUwAAAFU"]
[Mon Nov 24 04:59:54.588649 2025] [:error] [pid 12999:tid 13006] [client 52.236.123.156:39959] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/po.php"] [unique_id "aSN1yltj_teEYJ8vu7EC6AAAAMM"]
[Mon Nov 24 04:59:56.356791 2025] [:error] [pid 12999:tid 13008] [client 52.236.123.156:40595] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/po.php"] [unique_id "aSN1zFtj_teEYJ8vu7EC7AAAAMU"]
[Mon Nov 24 04:59:57.376920 2025] [:error] [pid 12912:tid 12981] [client 52.236.123.156:56359] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/po.php"] [unique_id "aSN1zZMj_Lgt36UonYKyPAAAAIw"]
[Mon Nov 24 05:00:01.472964 2025] [:error] [pid 12999:tid 13018] [client 52.236.123.156:40109] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zews.php"] [unique_id "aSN10Vtj_teEYJ8vu7EC9AAAAM8"]
[Mon Nov 24 05:00:04.716663 2025] [:error] [pid 12911:tid 12948] [client 52.236.123.156:40079] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zews.php"] [unique_id "aSN11EDMbk9464jnIl7eZgAAAEY"]
[Mon Nov 24 05:00:06.414999 2025] [:error] [pid 12999:tid 13027] [client 52.236.123.156:40112] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zews.php"] [unique_id "aSN11ltj_teEYJ8vu7EC-QAAANg"]
[Mon Nov 24 05:00:07.738062 2025] [:error] [pid 12911:tid 12958] [client 52.236.123.156:56333] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zews.php"] [unique_id "aSN110DMbk9464jnIl7edQAAAFA"]
[Mon Nov 24 05:00:10.920355 2025] [:error] [pid 12910:tid 12922] [client 52.236.123.156:39973] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN12mkWgvzAF2Nei2Vl0wAAAAc"]
[Mon Nov 24 05:00:18.128198 2025] [:error] [pid 12910:tid 12928] [client 52.236.123.156:40622] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN14mkWgvzAF2Nei2Vl3AAAAA0"]
[Mon Nov 24 05:00:22.120518 2025] [:error] [pid 12911:tid 12946] [client 52.236.123.156:40074] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN15kDMbk9464jnIl7epAAAAEQ"]
[Mon Nov 24 05:00:25.900770 2025] [:error] [pid 12999:tid 13019] [client 52.236.123.156:40576] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usage-file.php"] [unique_id "aSN16Vtj_teEYJ8vu7EDLgAAANA"]
[Mon Nov 24 05:00:30.246672 2025] [:error] [pid 12912:tid 12989] [client 52.236.123.156:39963] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usage-file.php"] [unique_id "aSN17pMj_Lgt36UonYKyYwAAAJQ"]
[Mon Nov 24 05:00:33.272840 2025] [:error] [pid 12912:tid 12991] [client 52.236.123.156:39998] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usage-file.php"] [unique_id "aSN18ZMj_Lgt36UonYKyagAAAJY"]
[Mon Nov 24 05:00:35.712785 2025] [:error] [pid 12910:tid 12929] [client 52.236.123.156:39996] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/usage-file.php"] [unique_id "aSN182kWgvzAF2Nei2Vl6wAAAA4"]
[Mon Nov 24 05:00:38.803887 2025] [:error] [pid 12999:tid 13003] [client 52.236.123.156:40643] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/assets/js/wp-config.php"] [unique_id "aSN19ltj_teEYJ8vu7EDOwAAAMA"]
[Mon Nov 24 05:01:12.527384 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:40579] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSN2GFtj_teEYJ8vu7EDbgAAAMo"]
[Mon Nov 24 05:01:15.375924 2025] [:error] [pid 12999:tid 13016] [client 52.236.123.156:40078] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSN2G1tj_teEYJ8vu7EDdwAAAM0"]
[Mon Nov 24 05:01:21.712889 2025] [:error] [pid 12999:tid 13020] [client 52.236.123.156:56343] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSN2IVtj_teEYJ8vu7EDfgAAANE"]
[Mon Nov 24 05:01:22.935496 2025] [:error] [pid 12910:tid 12923] [client 52.236.123.156:40094] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahax.php"] [unique_id "aSN2ImkWgvzAF2Nei2VmDAAAAAg"]
[Mon Nov 24 06:04:41.212236 2025] [:error] [pid 12999:tid 13026] [client 51.75.201.180:37702] [client 51.75.201.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.75.201.180, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSOE-Vtj_teEYJ8vu7EYEgAAANc"]
[Mon Nov 24 06:04:45.926752 2025] [:error] [pid 53508:tid 53534] [client 51.75.201.180:52448] [client 51.75.201.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.75.201.180, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSOE_W639qxbKCcL09zC-QAAARg"]
[Mon Nov 24 06:04:50.228031 2025] [:error] [pid 12999:tid 13022] [client 51.75.201.180:52474] [client 51.75.201.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.75.201.180, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSOFAltj_teEYJ8vu7EYFgAAANM"]
[Mon Nov 24 06:10:53.325707 2025] [:error] [pid 53508:tid 53531] [client 52.236.123.156:63284] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSOGbW639qxbKCcL09zFVgAAARU"]
[Mon Nov 24 06:11:00.756018 2025] [:error] [pid 12910:tid 12929] [client 52.236.123.156:36709] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSOGdGkWgvzAF2Nei2V4nQAAAA4"]
[Mon Nov 24 06:11:03.461999 2025] [:error] [pid 12911:tid 12957] [client 52.236.123.156:36829] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSOGd0DMbk9464jnIl7w7gAAAE8"]
[Mon Nov 24 06:35:14.791393 2025] [:error] [pid 12999:tid 13017] [client 20.238.52.119:60322] [client 20.238.52.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/backup"] [unique_id "aSOMIltj_teEYJ8vu7EpMgAAAM4"]
[Mon Nov 24 08:20:58.664802 2025] [:error] [pid 48600:tid 48640] [client 103.65.237.124:49710] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "aSOk6vtOzSUAQvWVjBcKbwAAAco"]
[Mon Nov 24 08:20:58.983116 2025] [:error] [pid 48600:tid 48645] [client 103.65.237.124:56178] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.vscode/sftp.json"] [unique_id "aSOk6vtOzSUAQvWVjBcKcAAAAc8"]
[Mon Nov 24 10:10:21.674437 2025] [:error] [pid 16516:tid 16525] [client 182.42.110.255:58865] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSO-jfqZbniwaNwL8XmqogAAAQY"]
[Mon Nov 24 11:20:24.728762 2025] [ssl:error] [pid 49900:tid 49909] [client 47.128.122.119:62824] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Mon Nov 24 11:27:33.625372 2025] [ssl:error] [pid 48688:tid 48700] [client 47.128.111.148:32124] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: http://paramountestate.com/robots.txt
[Mon Nov 24 12:07:03.595689 2025] [:error] [pid 16441:tid 16467] [client 103.12.76.247:46550] [client 103.12.76.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.12.76.247, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSPZ54q_bc5MOa9HflnJkQAAAJc"]
[Mon Nov 24 12:07:07.334296 2025] [:error] [pid 49900:tid 49909] [client 103.12.76.247:56748] [client 103.12.76.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.12.76.247, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSPZ6zCyPLrvg06aornLMAAAAAc"]
[Mon Nov 24 12:07:10.790950 2025] [:error] [pid 48599:tid 48621] [client 103.12.76.247:57508] [client 103.12.76.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.12.76.247, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSPZ7pzvu6PDJiRKE3LyhgAAAZI"]
[Mon Nov 24 20:20:36.981467 2025] [:error] [pid 48600:tid 48633] [client 3.222.221.187:36972] [client 3.222.221.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.222.221.187, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSRNlPtOzSUAQvWVjBeWNQAAAcM"]
[Mon Nov 24 20:21:02.049243 2025] [:error] [pid 16441:tid 16464] [client 3.222.221.187:56234] [client 3.222.221.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.222.221.187, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSRNroq_bc5MOa9Hfll22AAAAJQ"]
[Mon Nov 24 21:37:29.328611 2025] [:error] [pid 16516:tid 16526] [client 2.57.170.84:57187] [client 2.57.170.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSRfmfqZbniwaNwL8XkK_AAAAQc"]
[Mon Nov 24 21:37:31.153699 2025] [:error] [pid 49900:tid 49903] [client 2.57.170.102:48081] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aSRfmzCyPLrvg06aorlHcAAAAAE"]
[Mon Nov 24 21:37:35.827755 2025] [:error] [pid 16441:tid 16444] [client 2.57.170.108:22307] [client 2.57.170.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSRfn4q_bc5MOa9HflmQhQAAAIA"]
[Mon Nov 24 21:37:38.804157 2025] [:error] [pid 16516:tid 16536] [client 2.57.170.102:42843] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSRfovqZbniwaNwL8XkLBAAAARE"]
[Mon Nov 24 21:37:40.834013 2025] [:error] [pid 9630:tid 9645] [client 2.57.170.68:25869] [client 2.57.170.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSRfpCrSgUgPGkizt2o1zwAAAE0"]
[Mon Nov 24 21:37:41.849030 2025] [:error] [pid 16593:tid 16596] [client 2.57.170.105:26217] [client 2.57.170.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSRfpRVGznHBJI2LKpRqqAAAAoE"]
[Mon Nov 24 21:37:44.502609 2025] [:error] [pid 16593:tid 16598] [client 2.57.170.71:20519] [client 2.57.170.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSRfqBVGznHBJI2LKpRqrAAAAoM"]
[Mon Nov 24 21:37:47.846541 2025] [:error] [pid 16441:tid 16449] [client 2.57.170.74:31627] [client 2.57.170.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSRfq4q_bc5MOa9HflmQkAAAAIU"]
[Mon Nov 24 21:37:52.323579 2025] [:error] [pid 16441:tid 16464] [client 2.57.170.82:34287] [client 2.57.170.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSRfsIq_bc5MOa9HflmQoQAAAJQ"]
[Mon Nov 24 21:37:53.324070 2025] [:error] [pid 48688:tid 48696] [client 2.57.170.68:54659] [client 2.57.170.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSRfsRm2q1FkzLam7A3OJwAAAkQ"]
[Mon Nov 24 21:38:17.337339 2025] [:error] [pid 9630:tid 9635] [client 2.57.170.81:37971] [client 2.57.170.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.81, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSRfySrSgUgPGkizt2o2PAAAAEM"]
[Mon Nov 24 21:38:19.776988 2025] [:error] [pid 9630:tid 9655] [client 2.57.170.81:37971] [client 2.57.170.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aSRfyyrSgUgPGkizt2o2RQAAAFc"]
[Mon Nov 24 21:38:30.340048 2025] [:error] [pid 16549:tid 16567] [client 2.57.170.80:58483] [client 2.57.170.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSRf1qeWW19A99PUw_dmtgAAAU8"]
[Mon Nov 24 21:38:48.197435 2025] [:error] [pid 16441:tid 16456] [client 2.57.170.82:34627] [client 2.57.170.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/lx.php"] [unique_id "aSRf6Iq_bc5MOa9HflmRMgAAAIw"]
[Mon Nov 24 21:39:19.472870 2025] [:error] [pid 16516:tid 16540] [client 2.57.170.80:29221] [client 2.57.170.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/F0x.php"] [unique_id "aSRgB_qZbniwaNwL8XkLpQAAARU"]
[Mon Nov 24 21:39:36.004895 2025] [:error] [pid 48600:tid 48633] [client 2.57.170.97:29175] [client 2.57.170.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSRgGPtOzSUAQvWVjBehCQAAAcM"]
[Mon Nov 24 21:39:38.156479 2025] [:error] [pid 16516:tid 16524] [client 2.57.170.109:39771] [client 2.57.170.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.57.170.109, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSRgGvqZbniwaNwL8XkLvgAAAQU"]
[Mon Nov 24 21:39:39.592632 2025] [:error] [pid 16516:tid 16531] [client 2.57.170.109:39771] [client 2.57.170.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSRgG_qZbniwaNwL8XkLwwAAAQw"]
[Mon Nov 24 21:39:45.782210 2025] [:error] [pid 48601:tid 48681] [client 2.57.170.111:29837] [client 2.57.170.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSRgIYMM4MaVTk74-Abl1gAAAhg"]
[Mon Nov 24 21:39:55.935883 2025] [:error] [pid 16593:tid 16615] [client 2.57.170.102:28253] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "aSRgKxVGznHBJI2LKpRrJgAAApQ"]
[Mon Nov 24 21:39:56.959562 2025] [:error] [pid 9630:tid 9643] [client 2.57.170.88:58563] [client 2.57.170.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSRgLCrSgUgPGkizt2o2wQAAAEs"]
[Mon Nov 24 21:39:58.046181 2025] [:error] [pid 48601:tid 48675] [client 2.57.170.83:45083] [client 2.57.170.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aSRgLoMM4MaVTk74-Abl4QAAAhI"]
[Mon Nov 24 21:39:59.157018 2025] [:error] [pid 16593:tid 16601] [client 2.57.170.102:45059] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/about.php"] [unique_id "aSRgLxVGznHBJI2LKpRrKAAAAoY"]
[Mon Nov 24 21:40:02.116301 2025] [:error] [pid 16441:tid 16466] [client 2.57.170.110:61195] [client 2.57.170.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.110, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSRgMoq_bc5MOa9HflmRgAAAAJY"]
[Mon Nov 24 21:40:11.789719 2025] [:error] [pid 16441:tid 16453] [client 2.57.170.110:61195] [client 2.57.170.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSRgO4q_bc5MOa9HflmRlQAAAIk"]
[Mon Nov 24 21:40:17.347421 2025] [:error] [pid 49900:tid 49906] [client 2.57.170.81:35893] [client 2.57.170.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.81, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSRgQTCyPLrvg06aorlIKQAAAAQ"]
[Mon Nov 24 21:40:21.251656 2025] [:error] [pid 49900:tid 49923] [client 2.57.170.81:35893] [client 2.57.170.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aSRgRTCyPLrvg06aorlIMgAAABU"]
[Mon Nov 24 21:40:22.233222 2025] [:error] [pid 48601:tid 48675] [client 2.57.170.95:29689] [client 2.57.170.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "aSRgRoMM4MaVTk74-Abl8AAAAhI"]
[Mon Nov 24 21:40:26.225981 2025] [proxy_fcgi:error] [pid 48601:tid 48673] [client 2.57.170.90:44675] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:40:32.134499 2025] [proxy_fcgi:error] [pid 48601:tid 48675] [client 2.57.170.90:44675] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:40:41.212308 2025] [:error] [pid 48601:tid 48667] [client 2.57.170.90:44675] [client 2.57.170.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSRgWYMM4MaVTk74-AbmEAAAAgo"]
[Mon Nov 24 21:40:45.465783 2025] [:error] [pid 49900:tid 49912] [client 2.57.170.112:30673] [client 2.57.170.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bak.php"] [unique_id "aSRgXTCyPLrvg06aorlIUQAAAAo"]
[Mon Nov 24 21:40:46.899394 2025] [:error] [pid 9630:tid 9655] [client 2.57.170.101:57385] [client 2.57.170.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSRgXirSgUgPGkizt2o25AAAAFc"]
[Mon Nov 24 21:40:54.277494 2025] [:error] [pid 16549:tid 16574] [client 2.57.170.58:63243] [client 2.57.170.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aSRgZqeWW19A99PUw_dnPgAAAVU"]
[Mon Nov 24 21:40:56.838756 2025] [:error] [pid 48688:tid 48706] [client 2.57.170.113:52871] [client 2.57.170.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aSRgaBm2q1FkzLam7A3OuAAAAk4"]
[Mon Nov 24 21:40:58.875495 2025] [:error] [pid 48688:tid 48705] [client 2.57.170.101:47531] [client 2.57.170.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.101, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aSRgahm2q1FkzLam7A3OuwAAAk0"]
[Mon Nov 24 21:41:00.680078 2025] [:error] [pid 48688:tid 48696] [client 2.57.170.101:47531] [client 2.57.170.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/themes.php"] [unique_id "aSRgbBm2q1FkzLam7A3OxAAAAkQ"]
[Mon Nov 24 21:41:12.738965 2025] [:error] [pid 48688:tid 48716] [client 2.57.170.102:25851] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aSRgeBm2q1FkzLam7A3OzQAAAlg"]
[Mon Nov 24 21:41:14.813164 2025] [:error] [pid 9630:tid 9640] [client 2.57.170.100:50663] [client 2.57.170.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/about.php"] [unique_id "aSRgeirSgUgPGkizt2o29QAAAEg"]
[Mon Nov 24 21:41:16.718441 2025] [:error] [pid 16441:tid 16461] [client 2.57.170.90:31035] [client 2.57.170.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSRgfIq_bc5MOa9HflmRxgAAAJE"]
[Mon Nov 24 21:41:19.844085 2025] [:error] [pid 9630:tid 9645] [client 2.57.170.90:59251] [client 2.57.170.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.90, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aSRgfyrSgUgPGkizt2o2-wAAAE0"]
[Mon Nov 24 21:41:21.185010 2025] [:error] [pid 9630:tid 9647] [client 2.57.170.90:59251] [client 2.57.170.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aSRggSrSgUgPGkizt2o3AAAAAE8"]
[Mon Nov 24 21:41:22.172695 2025] [:error] [pid 49900:tid 49919] [client 2.57.170.67:29383] [client 2.57.170.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSRggjCyPLrvg06aorlIdgAAABE"]
[Mon Nov 24 21:41:29.324659 2025] [:error] [pid 16516:tid 16542] [client 2.57.170.96:30117] [client 2.57.170.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSRgifqZbniwaNwL8XkL9QAAARc"]
[Mon Nov 24 21:41:32.555642 2025] [:error] [pid 48688:tid 48714] [client 2.57.170.81:54039] [client 2.57.170.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aSRgjBm2q1FkzLam7A3O2wAAAlY"]
[Mon Nov 24 21:41:35.541286 2025] [:error] [pid 16516:tid 16525] [client 2.57.170.112:34527] [client 2.57.170.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/about.php"] [unique_id "aSRgj_qZbniwaNwL8XkL9gAAAQY"]
[Mon Nov 24 21:41:37.476499 2025] [:error] [pid 48601:tid 48664] [client 2.57.170.99:58353] [client 2.57.170.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aSRgkYMM4MaVTk74-AbmLQAAAgc"]
[Mon Nov 24 21:41:38.419280 2025] [:error] [pid 48599:tid 48608] [client 2.57.170.69:31035] [client 2.57.170.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSRgkpzvu6PDJiRKE3JPbgAAAYU"]
[Mon Nov 24 21:41:42.397943 2025] [:error] [pid 16549:tid 16556] [client 2.57.170.79:30363] [client 2.57.170.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aSRglqeWW19A99PUw_dnWAAAAUQ"]
[Mon Nov 24 21:41:46.852776 2025] [:error] [pid 16441:tid 16445] [client 2.57.170.101:25057] [client 2.57.170.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSRgmoq_bc5MOa9HflmR7gAAAIE"]
[Mon Nov 24 21:41:48.778667 2025] [:error] [pid 16549:tid 16558] [client 2.57.170.78:26833] [client 2.57.170.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSRgnKeWW19A99PUw_dnXAAAAUY"]
[Mon Nov 24 21:41:51.210023 2025] [:error] [pid 49900:tid 49920] [client 2.57.170.58:41371] [client 2.57.170.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aSRgnzCyPLrvg06aorlIkgAAABI"]
[Mon Nov 24 21:41:56.017010 2025] [:error] [pid 48600:tid 48650] [client 2.57.170.110:47635] [client 2.57.170.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSRgpPtOzSUAQvWVjBehdgAAAdQ"]
[Mon Nov 24 21:41:57.798123 2025] [:error] [pid 49900:tid 49903] [client 2.57.170.58:28649] [client 2.57.170.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aSRgpTCyPLrvg06aorlImgAAAAE"]
[Mon Nov 24 21:41:59.116246 2025] [:error] [pid 16549:tid 16561] [client 2.57.170.83:55163] [client 2.57.170.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSRgp6eWW19A99PUw_dnYQAAAUk"]
[Mon Nov 24 21:42:04.127609 2025] [:error] [pid 16593:tid 16604] [client 2.57.170.96:33943] [client 2.57.170.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "aSRgrBVGznHBJI2LKpRrdgAAAok"]
[Mon Nov 24 21:42:06.898810 2025] [:error] [pid 16593:tid 16598] [client 2.57.170.96:33943] [client 2.57.170.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aSRgrhVGznHBJI2LKpRreAAAAoM"]
[Mon Nov 24 21:42:07.846776 2025] [:error] [pid 49900:tid 49905] [client 2.57.170.106:62435] [client 2.57.170.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSRgrzCyPLrvg06aorlInwAAAAM"]
[Mon Nov 24 21:42:15.725163 2025] [:error] [pid 16516:tid 16536] [client 2.57.170.97:51069] [client 2.57.170.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.97, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aSRgt_qZbniwaNwL8XkMEAAAARE"]
[Mon Nov 24 21:42:16.279141 2025] [:error] [pid 16516:tid 16538] [client 2.57.170.97:51069] [client 2.57.170.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSRguPqZbniwaNwL8XkMEQAAARM"]
[Mon Nov 24 21:42:20.258607 2025] [:error] [pid 16441:tid 16449] [client 2.57.170.97:24889] [client 2.57.170.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/network.php"] [unique_id "aSRgvIq_bc5MOa9HflmSKAAAAIU"]
[Mon Nov 24 21:42:21.150369 2025] [:error] [pid 49900:tid 49917] [client 2.57.170.114:23423] [client 2.57.170.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "aSRgvTCyPLrvg06aorlIqQAAAA8"]
[Mon Nov 24 21:42:23.857284 2025] [:error] [pid 48600:tid 48632] [client 2.57.170.95:57737] [client 2.57.170.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aSRgv_tOzSUAQvWVjBehhAAAAcI"]
[Mon Nov 24 21:42:37.216753 2025] [:error] [pid 48688:tid 48708] [client 2.57.170.76:26637] [client 2.57.170.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSRgzRm2q1FkzLam7A3O_wAAAlA"]
[Mon Nov 24 21:42:41.185025 2025] [:error] [pid 16549:tid 16566] [client 2.57.170.104:29759] [client 2.57.170.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSRg0aeWW19A99PUw_dndgAAAU4"]
[Mon Nov 24 21:42:46.073316 2025] [:error] [pid 16593:tid 16610] [client 2.57.170.111:52353] [client 2.57.170.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSRg1hVGznHBJI2LKpRrhwAAAo8"]
[Mon Nov 24 21:42:48.339282 2025] [:error] [pid 48599:tid 48610] [client 2.57.170.77:45243] [client 2.57.170.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSRg2Jzvu6PDJiRKE3JPoQAAAYc"]
[Mon Nov 24 21:42:49.751083 2025] [:error] [pid 48688:tid 48692] [client 2.57.170.103:52629] [client 2.57.170.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "aSRg2Rm2q1FkzLam7A3PDQAAAkA"]
[Mon Nov 24 21:42:51.210997 2025] [:error] [pid 16549:tid 16557] [client 2.57.170.79:59611] [client 2.57.170.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSRg26eWW19A99PUw_dngQAAAUU"]
[Mon Nov 24 21:42:52.657802 2025] [:error] [pid 16441:tid 16448] [client 2.57.170.75:48453] [client 2.57.170.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSRg3Iq_bc5MOa9HflmSRAAAAIQ"]
[Mon Nov 24 21:42:54.803532 2025] [:error] [pid 9630:tid 9639] [client 2.57.170.92:32337] [client 2.57.170.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSRg3irSgUgPGkizt2o3VAAAAEc"]
[Mon Nov 24 21:42:58.321254 2025] [:error] [pid 48599:tid 48606] [client 2.57.170.94:55077] [client 2.57.170.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSRg4pzvu6PDJiRKE3JPqgAAAYM"]
[Mon Nov 24 21:43:00.839923 2025] [:error] [pid 9630:tid 9645] [client 2.57.170.1:36157] [client 2.57.170.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSRg5CrSgUgPGkizt2o3WwAAAE0"]
[Mon Nov 24 21:43:04.028497 2025] [:error] [pid 16441:tid 16459] [client 2.57.170.73:56359] [client 2.57.170.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSRg6Iq_bc5MOa9HflmSVQAAAI8"]
[Mon Nov 24 21:43:06.465147 2025] [proxy_fcgi:error] [pid 48600:tid 48635] [client 2.57.170.88:40855] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:43:07.990780 2025] [:error] [pid 48600:tid 48644] [client 2.57.170.88:40855] [client 2.57.170.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aSRg6_tOzSUAQvWVjBehowAAAc4"]
[Mon Nov 24 21:43:17.424436 2025] [:error] [pid 16516:tid 16540] [client 2.57.170.102:56341] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aSRg9fqZbniwaNwL8XkMKwAAARU"]
[Mon Nov 24 21:43:19.416385 2025] [:error] [pid 49900:tid 49911] [client 2.57.170.95:39957] [client 2.57.170.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSRg9zCyPLrvg06aorlI2gAAAAk"]
[Mon Nov 24 21:43:21.700934 2025] [:error] [pid 48688:tid 48714] [client 2.57.170.98:27651] [client 2.57.170.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aSRg-Rm2q1FkzLam7A3PLwAAAlY"]
[Mon Nov 24 21:43:23.678992 2025] [:error] [pid 48599:tid 48616] [client 2.57.170.102:55253] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSRg-5zvu6PDJiRKE3JPvQAAAY0"]
[Mon Nov 24 21:43:25.032796 2025] [:error] [pid 16441:tid 16448] [client 2.57.170.57:37941] [client 2.57.170.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aSRg_Yq_bc5MOa9HflmSbAAAAIQ"]
[Mon Nov 24 21:43:29.955985 2025] [:error] [pid 48601:tid 48673] [client 2.57.170.109:37227] [client 2.57.170.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSRhAYMM4MaVTk74-AbmdwAAAhA"]
[Mon Nov 24 21:43:32.687869 2025] [:error] [pid 16593:tid 16601] [client 2.57.170.76:33141] [client 2.57.170.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.76, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aSRhBBVGznHBJI2LKpRrmwAAAoY"]
[Mon Nov 24 21:43:33.825748 2025] [:error] [pid 16593:tid 16606] [client 2.57.170.76:33141] [client 2.57.170.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSRhBRVGznHBJI2LKpRrngAAAos"]
[Mon Nov 24 21:43:36.293736 2025] [:error] [pid 48688:tid 48700] [client 2.57.170.58:63185] [client 2.57.170.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aSRhCBm2q1FkzLam7A3PNwAAAkg"]
[Mon Nov 24 21:43:38.603908 2025] [:error] [pid 48601:tid 48659] [client 2.57.170.73:58575] [client 2.57.170.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aSRhCoMM4MaVTk74-AbmfQAAAgI"]
[Mon Nov 24 21:43:42.064166 2025] [:error] [pid 49900:tid 49925] [client 2.57.170.109:29671] [client 2.57.170.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rk2.php"] [unique_id "aSRhDjCyPLrvg06aorlI7QAAABc"]
[Mon Nov 24 21:43:45.134942 2025] [proxy_fcgi:error] [pid 48599:tid 48609] [client 2.57.170.101:33629] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:43:49.330825 2025] [proxy_fcgi:error] [pid 48599:tid 48606] [client 2.57.170.101:33629] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:43:50.401045 2025] [:error] [pid 48599:tid 48613] [client 2.57.170.101:33629] [client 2.57.170.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugin.php"] [unique_id "aSRhFpzvu6PDJiRKE3JP0QAAAYo"]
[Mon Nov 24 21:43:52.873936 2025] [:error] [pid 48599:tid 48615] [client 2.57.170.99:44547] [client 2.57.170.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aSRhGJzvu6PDJiRKE3JP1wAAAYw"]
[Mon Nov 24 21:43:56.542080 2025] [:error] [pid 16549:tid 16555] [client 2.57.170.80:26097] [client 2.57.170.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.80, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSRhHKeWW19A99PUw_dnpwAAAUM"]
[Mon Nov 24 21:43:56.546803 2025] [proxy_fcgi:error] [pid 16549:tid 16555] [client 2.57.170.80:26097] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:43:59.424043 2025] [:error] [pid 16549:tid 16562] [client 2.57.170.80:26097] [client 2.57.170.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/mah.php"] [unique_id "aSRhH6eWW19A99PUw_dnrQAAAUo"]
[Mon Nov 24 21:44:00.267886 2025] [:error] [pid 48601:tid 48660] [client 2.57.170.102:46983] [client 2.57.170.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.102, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aSRhIIMM4MaVTk74-AbmhwAAAgM"]
[Mon Nov 24 21:44:01.368784 2025] [:error] [pid 48601:tid 48665] [client 2.57.170.102:46983] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aSRhIYMM4MaVTk74-AbmiAAAAgg"]
[Mon Nov 24 21:44:06.476815 2025] [proxy_fcgi:error] [pid 16441:tid 16465] [client 2.57.170.83:20969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:44:08.319998 2025] [:error] [pid 16441:tid 16448] [client 2.57.170.83:20969] [client 2.57.170.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSRhKIq_bc5MOa9HflmSlQAAAIQ"]
[Mon Nov 24 21:44:13.970124 2025] [:error] [pid 16441:tid 16444] [client 2.57.170.102:40145] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aSRhLYq_bc5MOa9HflmSnAAAAIA"]
[Mon Nov 24 21:44:17.351660 2025] [:error] [pid 48600:tid 48650] [client 2.57.170.106:39073] [client 2.57.170.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.106, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aSRhMftOzSUAQvWVjBehtgAAAdQ"]
[Mon Nov 24 21:44:22.927307 2025] [:error] [pid 48600:tid 48648] [client 2.57.170.106:39073] [client 2.57.170.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aSRhNvtOzSUAQvWVjBehxQAAAdI"]
[Mon Nov 24 21:44:24.214980 2025] [:error] [pid 48688:tid 48698] [client 2.57.170.78:29723] [client 2.57.170.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/packed.php"] [unique_id "aSRhOBm2q1FkzLam7A3PYwAAAkY"]
[Mon Nov 24 21:44:30.108728 2025] [:error] [pid 48601:tid 48663] [client 2.57.170.103:53173] [client 2.57.170.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/file.php"] [unique_id "aSRhPoMM4MaVTk74-AbmnQAAAgY"]
[Mon Nov 24 21:44:31.739068 2025] [:error] [pid 48601:tid 48669] [client 2.57.170.89:21307] [client 2.57.170.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSRhP4MM4MaVTk74-AbmpwAAAgw"]
[Mon Nov 24 21:44:33.195044 2025] [:error] [pid 16441:tid 16464] [client 2.57.170.84:61863] [client 2.57.170.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aSRhQYq_bc5MOa9HflmSpQAAAJQ"]
[Mon Nov 24 21:44:36.056617 2025] [:error] [pid 9630:tid 9635] [client 2.57.170.57:59661] [client 2.57.170.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.57, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aSRhRCrSgUgPGkizt2o31AAAAEM"]
[Mon Nov 24 21:44:36.542956 2025] [:error] [pid 9630:tid 9646] [client 2.57.170.57:59661] [client 2.57.170.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSRhRCrSgUgPGkizt2o31gAAAE4"]
[Mon Nov 24 21:44:41.087465 2025] [:error] [pid 16441:tid 16454] [client 2.57.170.88:55997] [client 2.57.170.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSRhSYq_bc5MOa9HflmSuQAAAIo"]
[Mon Nov 24 21:44:43.388803 2025] [:error] [pid 49900:tid 49909] [client 2.57.170.95:26385] [client 2.57.170.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aSRhSzCyPLrvg06aorlJFwAAAAc"]
[Mon Nov 24 21:44:46.798995 2025] [proxy_fcgi:error] [pid 49900:tid 49907] [client 2.57.170.1:22677] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:44:48.301418 2025] [proxy_fcgi:error] [pid 49900:tid 49903] [client 2.57.170.1:22677] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:44:48.743136 2025] [:error] [pid 49900:tid 49922] [client 2.57.170.1:22677] [client 2.57.170.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/function.php"] [unique_id "aSRhUDCyPLrvg06aorlJMQAAABQ"]
[Mon Nov 24 21:44:51.201252 2025] [:error] [pid 16593:tid 16606] [client 2.57.170.58:31619] [client 2.57.170.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/votes.php"] [unique_id "aSRhUxVGznHBJI2LKpRruwAAAos"]
[Mon Nov 24 21:44:58.230800 2025] [proxy_fcgi:error] [pid 16441:tid 16459] [client 2.57.170.85:45477] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:44:59.127428 2025] [:error] [pid 16441:tid 16454] [client 2.57.170.85:45477] [client 2.57.170.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/file.php"] [unique_id "aSRhW4q_bc5MOa9HflmS8AAAAIo"]
[Mon Nov 24 21:45:05.501372 2025] [:error] [pid 16516:tid 16542] [client 2.57.170.1:55823] [client 2.57.170.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aSRhYfqZbniwaNwL8XkMTAAAARc"]
[Mon Nov 24 21:45:13.893613 2025] [proxy_fcgi:error] [pid 16516:tid 16538] [client 2.57.170.86:35757] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:45:15.298604 2025] [:error] [pid 16516:tid 16522] [client 2.57.170.86:35757] [client 2.57.170.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aSRha_qZbniwaNwL8XkMWAAAAQM"]
[Mon Nov 24 21:45:16.257331 2025] [proxy_fcgi:error] [pid 49900:tid 49905] [client 2.57.170.82:20091] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:45:19.383757 2025] [:error] [pid 49900:tid 49914] [client 2.57.170.82:20091] [client 2.57.170.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSRhbzCyPLrvg06aorlJXQAAAAw"]
[Mon Nov 24 21:45:24.184163 2025] [:error] [pid 48599:tid 48615] [client 2.57.170.103:28213] [client 2.57.170.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/item.php"] [unique_id "aSRhdJzvu6PDJiRKE3JQIgAAAYw"]
[Mon Nov 24 21:45:29.845412 2025] [:error] [pid 16441:tid 16453] [client 2.57.170.112:46879] [client 2.57.170.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.112, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aSRheYq_bc5MOa9HflmTHgAAAIk"]
[Mon Nov 24 21:45:30.408365 2025] [:error] [pid 16441:tid 16459] [client 2.57.170.112:46879] [client 2.57.170.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.112, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSRheoq_bc5MOa9HflmTIQAAAI8"]
[Mon Nov 24 21:45:31.459712 2025] [:error] [pid 16441:tid 16462] [client 2.57.170.112:46879] [client 2.57.170.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/mani.php"] [unique_id "aSRhe4q_bc5MOa9HflmTJAAAAJI"]
[Mon Nov 24 21:45:38.478903 2025] [:error] [pid 48601:tid 48666] [client 193.32.126.212:54579] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSRhgoMM4MaVTk74-AbnAgAAAgk"]
[Mon Nov 24 21:45:38.525752 2025] [:error] [pid 49900:tid 49918] [client 2.57.170.102:62349] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/network.php"] [unique_id "aSRhgjCyPLrvg06aorlJjgAAABA"]
[Mon Nov 24 21:45:38.975097 2025] [:error] [pid 16516:tid 16529] [client 193.32.126.212:55209] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSRhgvqZbniwaNwL8XkMfAAAAQo"]
[Mon Nov 24 21:45:39.467828 2025] [:error] [pid 49900:tid 49911] [client 193.32.126.212:55697] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSRhgzCyPLrvg06aorlJkgAAAAk"]
[Mon Nov 24 21:45:40.501651 2025] [:error] [pid 16441:tid 16446] [client 2.57.170.103:26201] [client 2.57.170.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "aSRhhIq_bc5MOa9HflmTaAAAAII"]
[Mon Nov 24 21:45:45.597043 2025] [proxy_fcgi:error] [pid 49900:tid 49913] [client 2.57.170.80:40339] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:45:47.113004 2025] [proxy_fcgi:error] [pid 49900:tid 49910] [client 2.57.170.80:40339] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:45:48.069659 2025] [:error] [pid 49900:tid 49919] [client 2.57.170.80:40339] [client 2.57.170.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSRhjDCyPLrvg06aorlJ4gAAABE"]
[Mon Nov 24 21:45:48.926120 2025] [:error] [pid 48688:tid 48704] [client 2.57.170.92:51231] [client 2.57.170.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aSRhjBm2q1FkzLam7A3P8wAAAkw"]
[Mon Nov 24 21:45:52.836648 2025] [:error] [pid 48688:tid 48711] [client 2.57.170.69:29881] [client 2.57.170.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.69, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/wp-login.php"] [unique_id "aSRhkBm2q1FkzLam7A3P_QAAAlM"]
[Mon Nov 24 21:45:55.783875 2025] [:error] [pid 48688:tid 48704] [client 2.57.170.69:29881] [client 2.57.170.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aSRhkxm2q1FkzLam7A3QAQAAAkw"]
[Mon Nov 24 21:45:57.520314 2025] [:error] [pid 16441:tid 16464] [client 2.57.170.103:31553] [client 2.57.170.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aSRhlYq_bc5MOa9HflmTngAAAJQ"]
[Mon Nov 24 21:45:58.501633 2025] [:error] [pid 48601:tid 48669] [client 2.57.170.67:51423] [client 2.57.170.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSRhloMM4MaVTk74-AbnKwAAAgw"]
[Mon Nov 24 21:46:01.046819 2025] [:error] [pid 16516:tid 16533] [client 2.57.170.96:58291] [client 2.57.170.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSRhmfqZbniwaNwL8XkMrAAAAQ4"]
[Mon Nov 24 21:46:06.330669 2025] [proxy_fcgi:error] [pid 16441:tid 16450] [client 2.57.170.107:27789] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:46:07.409904 2025] [:error] [pid 16441:tid 16467] [client 2.57.170.107:27789] [client 2.57.170.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aSRhn4q_bc5MOa9HflmT8QAAAJc"]
[Mon Nov 24 21:46:10.295546 2025] [proxy_fcgi:error] [pid 16549:tid 16565] [client 2.57.170.105:48983] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:46:18.114670 2025] [:error] [pid 16549:tid 16569] [client 2.57.170.105:48983] [client 2.57.170.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/radio.php"] [unique_id "aSRhqqeWW19A99PUw_doNgAAAVE"]
[Mon Nov 24 21:46:23.206470 2025] [:error] [pid 16441:tid 16454] [client 2.57.170.71:30275] [client 2.57.170.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aSRhr4q_bc5MOa9HflmUHgAAAIo"]
[Mon Nov 24 21:46:27.619860 2025] [:error] [pid 16441:tid 16457] [client 2.57.170.98:60295] [client 2.57.170.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aSRhs4q_bc5MOa9HflmUKwAAAI0"]
[Mon Nov 24 21:46:30.299702 2025] [:error] [pid 16593:tid 16598] [client 2.57.170.107:53105] [client 2.57.170.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aSRhthVGznHBJI2LKpRsRAAAAoM"]
[Mon Nov 24 21:46:36.286836 2025] [:error] [pid 48599:tid 48609] [client 2.57.170.78:24973] [client 2.57.170.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aSRhvJzvu6PDJiRKE3JQggAAAYY"]
[Mon Nov 24 21:46:37.132514 2025] [:error] [pid 16593:tid 16597] [client 2.57.170.78:21987] [client 2.57.170.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSRhvRVGznHBJI2LKpRsRQAAAoI"]
[Mon Nov 24 21:46:41.866203 2025] [:error] [pid 48599:tid 48610] [client 2.57.170.106:61327] [client 2.57.170.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aSRhwZzvu6PDJiRKE3JQkwAAAYc"]
[Mon Nov 24 21:47:00.405928 2025] [proxy_fcgi:error] [pid 9630:tid 9634] [client 2.57.170.92:50411] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:47:01.685946 2025] [:error] [pid 9630:tid 9632] [client 2.57.170.92:50411] [client 2.57.170.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/include.php"] [unique_id "aSRh1SrSgUgPGkizt2o5DwAAAEA"]
[Mon Nov 24 21:47:11.900786 2025] [:error] [pid 9630:tid 9656] [client 2.57.170.97:48683] [client 2.57.170.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/css.php"] [unique_id "aSRh3yrSgUgPGkizt2o5NwAAAFg"]
[Mon Nov 24 21:47:20.224591 2025] [:error] [pid 16441:tid 16466] [client 2.57.170.106:64027] [client 2.57.170.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wso112233.php"] [unique_id "aSRh6Iq_bc5MOa9HflmUiwAAAJY"]
[Mon Nov 24 21:47:22.229863 2025] [:error] [pid 16441:tid 16452] [client 2.57.170.112:57679] [client 2.57.170.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSRh6oq_bc5MOa9HflmUjQAAAIg"]
[Mon Nov 24 21:47:24.300223 2025] [:error] [pid 9630:tid 9652] [client 2.57.170.57:64253] [client 2.57.170.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/dropdown.php"] [unique_id "aSRh7CrSgUgPGkizt2o5TwAAAFQ"]
[Mon Nov 24 21:47:25.726088 2025] [:error] [pid 16516:tid 16524] [client 2.57.170.74:55815] [client 2.57.170.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/repeater.php"] [unique_id "aSRh7fqZbniwaNwL8XkMxwAAAQU"]
[Mon Nov 24 21:47:35.697658 2025] [:error] [pid 48601:tid 48678] [client 2.57.170.96:27205] [client 2.57.170.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aSRh94MM4MaVTk74-AbnbwAAAhU"]
[Mon Nov 24 21:47:38.210457 2025] [:error] [pid 16516:tid 16543] [client 2.57.170.108:59021] [client 2.57.170.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aSRh-vqZbniwaNwL8XkMygAAARg"]
[Mon Nov 24 21:47:39.884089 2025] [:error] [pid 49900:tid 49915] [client 2.57.170.73:59323] [client 2.57.170.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/options.php"] [unique_id "aSRh-zCyPLrvg06aorlKIAAAAA0"]
[Mon Nov 24 21:47:42.960768 2025] [:error] [pid 48599:tid 48624] [client 2.57.170.89:25577] [client 2.57.170.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aSRh_pzvu6PDJiRKE3JQvQAAAZU"]
[Mon Nov 24 21:47:44.046160 2025] [:error] [pid 16441:tid 16454] [client 2.57.170.100:53695] [client 2.57.170.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aSRiAIq_bc5MOa9HflmUpAAAAIo"]
[Mon Nov 24 21:47:46.292337 2025] [:error] [pid 48601:tid 48658] [client 2.57.170.112:34701] [client 2.57.170.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.112, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/images/wp-login.php"] [unique_id "aSRiAoMM4MaVTk74-AbndQAAAgE"]
[Mon Nov 24 21:47:50.007036 2025] [:error] [pid 48601:tid 48667] [client 2.57.170.112:34701] [client 2.57.170.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aSRiBoMM4MaVTk74-AbnfgAAAgo"]
[Mon Nov 24 21:47:53.207347 2025] [:error] [pid 9630:tid 9656] [client 2.57.170.90:37631] [client 2.57.170.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aSRiCSrSgUgPGkizt2o5bgAAAFg"]
[Mon Nov 24 21:47:55.735783 2025] [:error] [pid 16593:tid 16597] [client 2.57.170.86:23295] [client 2.57.170.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aSRiCxVGznHBJI2LKpRscQAAAoI"]
[Mon Nov 24 21:47:56.797773 2025] [proxy_fcgi:error] [pid 48601:tid 48677] [client 2.57.170.101:59783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 21:47:57.358930 2025] [:error] [pid 48601:tid 48671] [client 2.57.170.101:59783] [client 2.57.170.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.101, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aSRiDYMM4MaVTk74-AbnggAAAg4"]
[Mon Nov 24 21:47:58.579826 2025] [:error] [pid 48601:tid 48664] [client 2.57.170.101:59783] [client 2.57.170.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aSRiDoMM4MaVTk74-AbnhAAAAgc"]
[Mon Nov 24 21:48:01.811629 2025] [:error] [pid 9630:tid 9641] [client 2.57.170.83:32507] [client 2.57.170.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aSRiESrSgUgPGkizt2o5ewAAAEk"]
[Mon Nov 24 21:48:30.935238 2025] [:error] [pid 48688:tid 48711] [client 2.57.170.74:65221] [client 2.57.170.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.74, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSRiLhm2q1FkzLam7A3QWgAAAlM"]
[Mon Nov 24 21:48:32.885382 2025] [:error] [pid 48688:tid 48696] [client 2.57.170.74:65221] [client 2.57.170.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.74, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.tmb/wp-login.php"] [unique_id "aSRiMBm2q1FkzLam7A3QXwAAAkQ"]
[Mon Nov 24 21:48:35.010927 2025] [:error] [pid 48688:tid 48694] [client 2.57.170.74:65221] [client 2.57.170.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSRiMxm2q1FkzLam7A3QZAAAAkI"]
[Mon Nov 24 21:48:36.071919 2025] [:error] [pid 48688:tid 48713] [client 2.57.170.71:37411] [client 2.57.170.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aSRiNBm2q1FkzLam7A3QZwAAAlU"]
[Mon Nov 24 21:48:37.051450 2025] [:error] [pid 16549:tid 16553] [client 2.57.170.81:53277] [client 2.57.170.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/install.php"] [unique_id "aSRiNaeWW19A99PUw_docgAAAUE"]
[Mon Nov 24 21:48:46.820275 2025] [:error] [pid 16549:tid 16568] [client 2.57.170.83:58559] [client 2.57.170.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.83, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aSRiPqeWW19A99PUw_dogwAAAVA"]
[Mon Nov 24 21:48:47.242664 2025] [:error] [pid 16549:tid 16559] [client 2.57.170.83:58559] [client 2.57.170.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSRiP6eWW19A99PUw_dohAAAAUc"]
[Mon Nov 24 21:48:49.427771 2025] [:error] [pid 48599:tid 48623] [client 2.57.170.102:38513] [client 2.57.170.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.102, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSRiQZzvu6PDJiRKE3JQ7QAAAZQ"]
[Mon Nov 24 21:48:57.974898 2025] [:error] [pid 48599:tid 48607] [client 2.57.170.102:38513] [client 2.57.170.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aSRiSZzvu6PDJiRKE3JRDAAAAYQ"]
[Mon Nov 24 21:49:08.723605 2025] [:error] [pid 9630:tid 9655] [client 2.57.170.112:61457] [client 2.57.170.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSRiVCrSgUgPGkizt2o5ogAAAFc"]
[Mon Nov 24 21:49:18.882771 2025] [:error] [pid 16549:tid 16555] [client 2.57.170.98:41359] [client 2.57.170.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.98, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSRiXqeWW19A99PUw_doowAAAUM"]
[Mon Nov 24 21:49:25.804220 2025] [autoindex:error] [pid 16549:tid 16574] [client 2.57.170.98:41359] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 23:05:35.263736 2025] [:error] [pid 16441:tid 16460] [client 182.44.2.148:52175] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSR0P4q_bc5MOa9HflmznAAAAJA"]
[Tue Nov 25 05:21:01.420808 2025] [:error] [pid 14688:tid 14702] [client 180.102.134.69:37178] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSTMPW9vYrBoEsiDniziVQAAAQw"]
[Tue Nov 25 11:34:06.968758 2025] [:error] [pid 28609:tid 28627] [client 125.94.144.102:54725] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSUjriGGdT-nZJVs3x1RJgAAAYk"]
[Tue Nov 25 12:50:48.246544 2025] [:error] [pid 28739:tid 28768] [client 106.51.171.116:56342] [client 106.51.171.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.171.116, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSU1qBxGpKmlkG4FexQePwAAAgY"]
[Tue Nov 25 17:57:11.917236 2025] [:error] [pid 28740:tid 28810] [client 54.173.250.15:33440] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aSV9d1ppQCoYxWW6V0VhWgAAAlM"]
[Tue Nov 25 18:01:55.042172 2025] [:error] [pid 14078:tid 14146] [client 117.33.163.216:56758] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSV-k9VXYbb0ii_rVoIpUAAAAIk"]
[Tue Nov 25 18:53:15.555064 2025] [:error] [pid 28740:tid 28804] [client 138.199.60.187:55226] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSWKm1ppQCoYxWW6V0Vy2QAAAk0"]
[Tue Nov 25 18:53:15.791076 2025] [:error] [pid 28609:tid 28642] [client 138.199.60.187:55474] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSWKmyGGdT-nZJVs3x25EwAAAZg"]
[Tue Nov 25 18:53:16.070672 2025] [:error] [pid 14077:tid 14128] [client 138.199.60.187:55730] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSWKnBG9n7UHEkwDTyh-cAAAAFI"]
[Tue Nov 25 18:53:16.305931 2025] [:error] [pid 28609:tid 28621] [client 138.199.60.187:55918] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSWKnCGGdT-nZJVs3x25FwAAAYM"]
[Tue Nov 25 18:53:16.570010 2025] [:error] [pid 28836:tid 28967] [client 138.199.60.187:56134] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "aSWKnJwNRsoxcLQGkTe3zwAAAsw"]
[Tue Nov 25 18:53:16.808806 2025] [:error] [pid 14077:tid 14123] [client 138.199.60.187:56396] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnBG9n7UHEkwDTyh-fQAAAE0"]
[Tue Nov 25 18:53:17.076638 2025] [:error] [pid 14078:tid 14150] [client 138.199.60.187:56686] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKndVXYbb0ii_rVoI4FgAAAI0"]
[Tue Nov 25 18:53:17.334395 2025] [:error] [pid 2987:tid 3005] [client 138.199.60.187:56930] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnc-djEt-pTzPxnyUTgAAAVA"]
[Tue Nov 25 18:53:17.600247 2025] [:error] [pid 2987:tid 3002] [client 138.199.60.187:57070] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnc-djEt-pTzPxnyUUAAAAU0"]
[Tue Nov 25 18:53:17.854642 2025] [:error] [pid 28740:tid 28799] [client 138.199.60.187:53518] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnVppQCoYxWW6V0VzMAAAAkg"]
[Tue Nov 25 19:24:34.917965 2025] [proxy_fcgi:error] [pid 28739:tid 28763] [client 20.249.10.99:16004] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 19:24:36.242145 2025] [:error] [pid 28739:tid 28772] [client 20.249.10.99:16004] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/0.php"] [unique_id "aSWR9BxGpKmlkG4FexR4aQAAAgo"]
[Tue Nov 25 19:24:41.804063 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:15958] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/cs.php"] [unique_id "aSWR-dVXYbb0ii_rVoJB8AAAAJM"]
[Tue Nov 25 19:24:55.308921 2025] [:error] [pid 28836:tid 28967] [client 20.249.10.99:16008] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/kses.php"] [unique_id "aSWSB5wNRsoxcLQGkTfAWwAAAsw"]
[Tue Nov 25 19:24:56.842456 2025] [:error] [pid 14168:tid 14177] [client 20.249.10.99:15980] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jagoan.php"] [unique_id "aSWSCPR-ZDU0QEgAIItkpAAAAMY"]
[Tue Nov 25 19:24:58.053631 2025] [:error] [pid 2987:tid 2999] [client 20.249.10.99:15941] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jagoan.php"] [unique_id "aSWSCs-djEt-pTzPxnydjwAAAUo"]
[Tue Nov 25 19:24:58.836366 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:15978] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jagoan.php"] [unique_id "aSWSCnsB4Gz6Qw-pvBsSsgAAAAQ"]
[Tue Nov 25 19:24:59.642516 2025] [:error] [pid 28740:tid 28812] [client 20.249.10.99:15987] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/g3.php"] [unique_id "aSWSC1ppQCoYxWW6V0V-FwAAAlU"]
[Tue Nov 25 19:25:01.218394 2025] [:error] [pid 14076:tid 14084] [client 20.249.10.99:16016] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/g3.php"] [unique_id "aSWSDXsB4Gz6Qw-pvBsStAAAAAM"]
[Tue Nov 25 19:25:03.030796 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:15956] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/g3.php"] [unique_id "aSWSD8-djEt-pTzPxnydkgAAAUg"]
[Tue Nov 25 19:25:03.722309 2025] [:error] [pid 28842:tid 29001] [client 20.249.10.99:16009] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/images/g3.php"] [unique_id "aSWSD9NmoaPf6T4-6C2PUgAAA0s"]
[Tue Nov 25 19:25:07.331941 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:15984] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/zaza.php"] [unique_id "aSWSE3sB4Gz6Qw-pvBsSuQAAAAw"]
[Tue Nov 25 19:25:09.636316 2025] [:error] [pid 14078:tid 14142] [client 20.249.10.99:15889] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/zaza.php"] [unique_id "aSWSFdVXYbb0ii_rVoJCGgAAAIU"]
[Tue Nov 25 19:25:10.799873 2025] [:error] [pid 14077:tid 14115] [client 20.249.10.99:15942] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/zaza.php"] [unique_id "aSWSFhG9n7UHEkwDTyiMfgAAAEU"]
[Tue Nov 25 19:25:11.791086 2025] [:error] [pid 14076:tid 14087] [client 20.249.10.99:16033] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/zaza.php"] [unique_id "aSWSF3sB4Gz6Qw-pvBsSvwAAAAY"]
[Tue Nov 25 19:25:13.035988 2025] [:error] [pid 14078:tid 14154] [client 20.249.10.99:15976] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWSGdVXYbb0ii_rVoJCIQAAAJE"]
[Tue Nov 25 19:25:14.771323 2025] [:error] [pid 14168:tid 14194] [client 20.249.10.99:15967] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWSGvR-ZDU0QEgAIItktQAAANc"]
[Tue Nov 25 19:25:16.062761 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:15997] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWSHPR-ZDU0QEgAIItktwAAAMU"]
[Tue Nov 25 19:25:17.710745 2025] [:error] [pid 14168:tid 14195] [client 20.249.10.99:15963] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWSHfR-ZDU0QEgAIItkugAAANg"]
[Tue Nov 25 19:25:19.146185 2025] [:error] [pid 28836:tid 28963] [client 20.249.10.99:15957] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/htaccess.php"] [unique_id "aSWSH5wNRsoxcLQGkTfAbQAAAsg"]
[Tue Nov 25 19:25:20.575882 2025] [:error] [pid 14076:tid 14099] [client 20.249.10.99:15940] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/htaccess.php"] [unique_id "aSWSIHsB4Gz6Qw-pvBsSwwAAABI"]
[Tue Nov 25 19:25:21.332976 2025] [:error] [pid 14168:tid 14183] [client 20.249.10.99:16057] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/htaccess.php"] [unique_id "aSWSIfR-ZDU0QEgAIItkwAAAAMw"]
[Tue Nov 25 19:25:22.933431 2025] [:error] [pid 14168:tid 14189] [client 20.249.10.99:16014] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/htaccess.php"] [unique_id "aSWSIvR-ZDU0QEgAIItkwgAAANI"]
[Tue Nov 25 19:25:24.173393 2025] [:error] [pid 14168:tid 14187] [client 20.249.10.99:15977] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSWSJPR-ZDU0QEgAIItkxAAAANA"]
[Tue Nov 25 19:25:24.660808 2025] [:error] [pid 28842:tid 29020] [client 20.249.10.99:16015] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSWSJNNmoaPf6T4-6C2PgQAAA1I"]
[Tue Nov 25 19:25:27.492561 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:15979] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSWSJ5wNRsoxcLQGkTfAdwAAAsY"]
[Tue Nov 25 19:25:28.544269 2025] [:error] [pid 14077:tid 14122] [client 20.249.10.99:15990] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "aSWSKBG9n7UHEkwDTyiMlgAAAEw"]
[Tue Nov 25 19:25:29.649750 2025] [:error] [pid 14077:tid 14113] [client 20.249.10.99:15969] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "aSWSKRG9n7UHEkwDTyiMmAAAAEM"]
[Tue Nov 25 19:25:30.380461 2025] [:error] [pid 28609:tid 28634] [client 20.249.10.99:16013] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "aSWSKiGGdT-nZJVs3x3A8QAAAZA"]
[Tue Nov 25 19:25:32.078658 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:15998] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "aSWSLBG9n7UHEkwDTyiMnQAAAFI"]
[Tue Nov 25 19:25:34.170168 2025] [:error] [pid 14076:tid 14105] [client 20.249.10.99:15994] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "aSWSLnsB4Gz6Qw-pvBsSygAAABg"]
[Tue Nov 25 19:25:35.268065 2025] [:error] [pid 28740:tid 28815] [client 20.249.10.99:16001] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hob.php"] [unique_id "aSWSL1ppQCoYxWW6V0V-QwAAAlg"]
[Tue Nov 25 19:25:37.146863 2025] [:error] [pid 28739:tid 28776] [client 20.249.10.99:15971] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hob.php"] [unique_id "aSWSMRxGpKmlkG4FexR4kAAAAg4"]
[Tue Nov 25 19:25:37.951799 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:15950] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hob.php"] [unique_id "aSWSMRxGpKmlkG4FexR4kQAAAgA"]
[Tue Nov 25 19:25:38.813866 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:16043] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hob.php"] [unique_id "aSWSMhG9n7UHEkwDTyiMrAAAAEI"]
[Tue Nov 25 19:25:40.284207 2025] [:error] [pid 14078:tid 14149] [client 20.249.10.99:16003] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kal.php"] [unique_id "aSWSNNVXYbb0ii_rVoJCjQAAAIw"]
[Tue Nov 25 19:25:41.630019 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:15951] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kal.php"] [unique_id "aSWSNZwNRsoxcLQGkTfApwAAAtY"]
[Tue Nov 25 19:25:58.433068 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:15960] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWSRiGGdT-nZJVs3x3BDwAAAYM"]
[Tue Nov 25 19:25:59.970653 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:15970] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWSRyGGdT-nZJVs3x3BFQAAAYs"]
[Tue Nov 25 19:26:00.607844 2025] [:error] [pid 14077:tid 14127] [client 20.249.10.99:15954] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWSSBG9n7UHEkwDTyiM3gAAAFE"]
[Tue Nov 25 19:26:02.449164 2025] [:error] [pid 28836:tid 29010] [client 20.249.10.99:16028] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWSSpwNRsoxcLQGkTfAugAAAtQ"]
[Tue Nov 25 19:26:03.530657 2025] [:error] [pid 14077:tid 14111] [client 20.249.10.99:15937] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/max.php"] [unique_id "aSWSSxG9n7UHEkwDTyiM4wAAAEE"]
[Tue Nov 25 19:26:05.732265 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:16031] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/max.php"] [unique_id "aSWSTc-djEt-pTzPxnydvQAAAUg"]
[Tue Nov 25 19:26:07.419877 2025] [:error] [pid 28740:tid 28803] [client 20.249.10.99:15993] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/max.php"] [unique_id "aSWST1ppQCoYxWW6V0V-cQAAAkw"]
[Tue Nov 25 19:26:09.431030 2025] [:error] [pid 28836:tid 29008] [client 20.249.10.99:16053] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/max.php"] [unique_id "aSWSUZwNRsoxcLQGkTfAwwAAAtI"]
[Tue Nov 25 19:26:10.621084 2025] [:error] [pid 28609:tid 28640] [client 20.249.10.99:16051] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "aSWSUiGGdT-nZJVs3x3BJgAAAZY"]
[Tue Nov 25 19:26:11.454752 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:15964] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "aSWSUxG9n7UHEkwDTyiM_AAAAFg"]
[Tue Nov 25 19:26:12.678274 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:15955] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "aSWSVM-djEt-pTzPxnydygAAAUg"]
[Tue Nov 25 19:26:13.268663 2025] [:error] [pid 28842:tid 28991] [client 20.249.10.99:16005] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "aSWSVdNmoaPf6T4-6C2QAwAAA0E"]
[Tue Nov 25 19:26:14.584348 2025] [:error] [pid 14077:tid 14113] [client 20.249.10.99:16058] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/post.php"] [unique_id "aSWSVhG9n7UHEkwDTyiNAwAAAEM"]
[Tue Nov 25 19:26:16.172778 2025] [:error] [pid 28740:tid 28806] [client 20.249.10.99:16045] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/post.php"] [unique_id "aSWSWFppQCoYxWW6V0V-dQAAAk8"]
[Tue Nov 25 19:26:17.517908 2025] [:error] [pid 28740:tid 28811] [client 20.249.10.99:15968] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/post.php"] [unique_id "aSWSWVppQCoYxWW6V0V-eAAAAlQ"]
[Tue Nov 25 19:26:20.565848 2025] [:error] [pid 14076:tid 14104] [client 20.249.10.99:15962] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/post.php"] [unique_id "aSWSXHsB4Gz6Qw-pvBsS3wAAABc"]
[Tue Nov 25 19:26:21.592502 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:16007] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "aSWSXXsB4Gz6Qw-pvBsS4AAAAAQ"]
[Tue Nov 25 19:26:24.077199 2025] [:error] [pid 14077:tid 14125] [client 20.249.10.99:15875] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "aSWSYBG9n7UHEkwDTyiNBQAAAE8"]
[Tue Nov 25 19:26:25.227276 2025] [:error] [pid 28842:tid 29004] [client 20.249.10.99:15936] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "aSWSYdNmoaPf6T4-6C2QEAAAA04"]
[Tue Nov 25 19:26:27.294612 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:16002] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "aSWSYxxGpKmlkG4FexR4wwAAAgA"]
[Tue Nov 25 19:26:28.322921 2025] [:error] [pid 28842:tid 28991] [client 20.249.10.99:15973] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWSZNNmoaPf6T4-6C2QIwAAA0E"]
[Tue Nov 25 19:26:29.565996 2025] [:error] [pid 28609:tid 28633] [client 20.249.10.99:16036] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWSZSGGdT-nZJVs3x3BNwAAAY8"]
[Tue Nov 25 19:26:30.310650 2025] [:error] [pid 2987:tid 2999] [client 20.249.10.99:15944] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWSZs-djEt-pTzPxnyd0gAAAUo"]
[Tue Nov 25 19:26:31.311960 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:15874] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWSZ9VXYbb0ii_rVoJCtQAAAIk"]
[Tue Nov 25 19:26:32.061396 2025] [:error] [pid 28842:tid 28995] [client 20.249.10.99:16017] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWSaNNmoaPf6T4-6C2QLQAAA0U"]
[Tue Nov 25 19:26:34.005849 2025] [:error] [pid 14076:tid 14094] [client 20.249.10.99:16047] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWSansB4Gz6Qw-pvBsS7gAAAA0"]
[Tue Nov 25 19:26:36.570804 2025] [:error] [pid 28836:tid 28986] [client 20.249.10.99:16000] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWSbJwNRsoxcLQGkTfA1QAAAs8"]
[Tue Nov 25 19:26:37.347365 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:16059] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWSbRG9n7UHEkwDTyiNNwAAAFI"]
[Tue Nov 25 19:26:39.113254 2025] [:error] [pid 28740:tid 28799] [client 20.249.10.99:15975] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWSb1ppQCoYxWW6V0V-iwAAAkg"]
[Tue Nov 25 19:26:40.749848 2025] [:error] [pid 14077:tid 14120] [client 20.249.10.99:16052] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWScBG9n7UHEkwDTyiNOQAAAEo"]
[Tue Nov 25 19:26:42.085903 2025] [:error] [pid 28740:tid 28798] [client 20.249.10.99:15972] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWSclppQCoYxWW6V0V-jAAAAkc"]
[Tue Nov 25 19:26:43.586989 2025] [:error] [pid 28842:tid 29004] [client 20.249.10.99:16032] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWSc9NmoaPf6T4-6C2QPgAAA04"]
[Tue Nov 25 19:26:44.507318 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:15966] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWSdBxGpKmlkG4FexR4zQAAAhg"]
[Tue Nov 25 19:26:45.671629 2025] [:error] [pid 14168:tid 14171] [client 20.249.10.99:16021] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWSdfR-ZDU0QEgAIItk-gAAAMA"]
[Tue Nov 25 19:26:47.265061 2025] [:error] [pid 28836:tid 29011] [client 20.249.10.99:16012] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWSd5wNRsoxcLQGkTfA2wAAAtU"]
[Tue Nov 25 19:26:47.716975 2025] [:error] [pid 14168:tid 14187] [client 20.249.10.99:15899] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWSd_R-ZDU0QEgAIItk_gAAANA"]
[Tue Nov 25 19:26:48.308800 2025] [:error] [pid 14077:tid 14130] [client 20.249.10.99:15896] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "aSWSeBG9n7UHEkwDTyiNQQAAAFQ"]
[Tue Nov 25 19:26:53.478762 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:15953] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "aSWSfRxGpKmlkG4FexR41QAAAgA"]
[Tue Nov 25 19:26:54.945937 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:16026] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "aSWSfvR-ZDU0QEgAIItlCQAAAMU"]
[Tue Nov 25 19:26:56.616063 2025] [:error] [pid 14076:tid 14089] [client 20.249.10.99:16027] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "aSWSgHsB4Gz6Qw-pvBsS_wAAAAg"]
[Tue Nov 25 19:27:08.885320 2025] [:error] [pid 14076:tid 14095] [client 20.249.10.99:15908] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSWSjHsB4Gz6Qw-pvBsTCwAAAA4"]
[Tue Nov 25 19:27:14.629630 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:15906] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aSWSkhG9n7UHEkwDTyiN2gAAAFg"]
[Tue Nov 25 19:27:15.321639 2025] [:error] [pid 28740:tid 28802] [client 20.249.10.99:15878] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aSWSk1ppQCoYxWW6V0V-6AAAAks"]
[Tue Nov 25 19:27:16.287670 2025] [:error] [pid 14168:tid 14173] [client 20.249.10.99:15981] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aSWSlPR-ZDU0QEgAIItlGAAAAMI"]
[Tue Nov 25 19:27:17.573982 2025] [:error] [pid 28740:tid 28803] [client 20.249.10.99:16056] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "aSWSlVppQCoYxWW6V0V-6gAAAkw"]
[Tue Nov 25 19:27:18.929500 2025] [:error] [pid 2987:tid 3012] [client 20.249.10.99:15946] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSWSls-djEt-pTzPxnyeAAAAAVc"]
[Tue Nov 25 19:27:20.187110 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:16038] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSWSmNVXYbb0ii_rVoJDHgAAAIY"]
[Tue Nov 25 19:27:20.924666 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:16060] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSWSmNVXYbb0ii_rVoJDHwAAAIE"]
[Tue Nov 25 19:27:21.897021 2025] [:error] [pid 14078:tid 14144] [client 20.249.10.99:15887] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "aSWSmdVXYbb0ii_rVoJDKQAAAIc"]
[Tue Nov 25 19:27:22.649727 2025] [:error] [pid 28609:tid 28620] [client 20.249.10.99:15992] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "aSWSmiGGdT-nZJVs3x3BVwAAAYI"]
[Tue Nov 25 19:27:23.635639 2025] [:error] [pid 28740:tid 28807] [client 20.249.10.99:16035] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "aSWSm1ppQCoYxWW6V0V-7gAAAlA"]
[Tue Nov 25 19:27:27.385121 2025] [:error] [pid 2987:tid 3013] [client 20.249.10.99:15901] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "aSWSn8-djEt-pTzPxnyeBgAAAVg"]
[Tue Nov 25 19:27:28.466111 2025] [:error] [pid 28740:tid 28812] [client 20.249.10.99:15939] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "aSWSoFppQCoYxWW6V0V-8gAAAlU"]
[Tue Nov 25 19:27:29.500831 2025] [:error] [pid 14168:tid 14190] [client 20.249.10.99:16041] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSWSofR-ZDU0QEgAIItlMwAAANM"]
[Tue Nov 25 19:27:30.641170 2025] [:error] [pid 28739:tid 28777] [client 20.249.10.99:15999] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSWSohxGpKmlkG4FexR4_gAAAg8"]
[Tue Nov 25 19:27:31.230440 2025] [:error] [pid 14076:tid 14103] [client 20.249.10.99:16040] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSWSo3sB4Gz6Qw-pvBsTFwAAABY"]
[Tue Nov 25 19:27:31.969363 2025] [:error] [pid 14076:tid 14088] [client 20.249.10.99:15945] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "aSWSo3sB4Gz6Qw-pvBsTGQAAAAc"]
[Tue Nov 25 19:27:32.966930 2025] [:error] [pid 28609:tid 28632] [client 20.249.10.99:16010] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aSWSpCGGdT-nZJVs3x3BXQAAAY4"]
[Tue Nov 25 19:27:34.893008 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:16030] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aSWSphG9n7UHEkwDTyiOBgAAAE0"]
[Tue Nov 25 19:27:35.626853 2025] [:error] [pid 2987:tid 2994] [client 20.249.10.99:16063] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aSWSp8-djEt-pTzPxnyeCQAAAUU"]
[Tue Nov 25 19:27:36.373823 2025] [:error] [pid 28740:tid 28813] [client 20.249.10.99:16023] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aSWSqFppQCoYxWW6V0V-9wAAAlY"]
[Tue Nov 25 19:27:37.908256 2025] [:error] [pid 28740:tid 28799] [client 20.249.10.99:15632] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSWSqVppQCoYxWW6V0V--gAAAkg"]
[Tue Nov 25 19:27:40.196624 2025] [:error] [pid 28836:tid 28959] [client 20.249.10.99:16046] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSWSrJwNRsoxcLQGkTfBGAAAAsQ"]
[Tue Nov 25 19:27:43.882030 2025] [:error] [pid 14168:tid 14183] [client 20.249.10.99:15872] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSWSr_R-ZDU0QEgAIItlUQAAAMw"]
[Tue Nov 25 19:27:45.249684 2025] [:error] [pid 28739:tid 28772] [client 20.249.10.99:15911] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/product.php"] [unique_id "aSWSsRxGpKmlkG4FexR5CgAAAgo"]
[Tue Nov 25 19:27:46.363183 2025] [:error] [pid 14077:tid 14126] [client 20.249.10.99:16048] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "aSWSshG9n7UHEkwDTyiOFwAAAFA"]
[Tue Nov 25 19:27:48.424126 2025] [:error] [pid 28842:tid 29003] [client 20.249.10.99:15907] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "aSWStNNmoaPf6T4-6C2QnAAAA00"]
[Tue Nov 25 19:27:49.872069 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:15882] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "aSWStRG9n7UHEkwDTyiOHQAAAFI"]
[Tue Nov 25 19:27:51.086720 2025] [:error] [pid 14077:tid 14125] [client 20.249.10.99:15900] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "aSWStxG9n7UHEkwDTyiOIgAAAE8"]
[Tue Nov 25 19:27:52.373187 2025] [:error] [pid 28609:tid 28622] [client 20.249.10.99:15986] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aSWSuCGGdT-nZJVs3x3BfgAAAYQ"]
[Tue Nov 25 19:27:54.061665 2025] [:error] [pid 14078:tid 14155] [client 20.249.10.99:15912] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aSWSutVXYbb0ii_rVoJDTAAAAJI"]
[Tue Nov 25 19:27:56.881850 2025] [:error] [pid 28609:tid 28632] [client 20.249.10.99:15637] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aSWSvCGGdT-nZJVs3x3BhwAAAY4"]
[Tue Nov 25 19:27:58.469632 2025] [:error] [pid 28842:tid 29024] [client 20.249.10.99:15886] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "aSWSvtNmoaPf6T4-6C2QrAAAA1Y"]
[Tue Nov 25 19:28:01.567589 2025] [:error] [pid 28739:tid 28785] [client 20.249.10.99:15929] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSWSwRxGpKmlkG4FexR5GgAAAhc"]
[Tue Nov 25 19:28:03.208939 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:15616] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSWSw9VXYbb0ii_rVoJDWQAAAIk"]
[Tue Nov 25 19:28:05.470855 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:15985] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSWSxdVXYbb0ii_rVoJDXQAAAJg"]
[Tue Nov 25 19:28:10.658798 2025] [:error] [pid 14076:tid 14104] [client 20.249.10.99:15974] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "aSWSynsB4Gz6Qw-pvBsTPgAAABc"]
[Tue Nov 25 19:28:12.052606 2025] [:error] [pid 28740:tid 28811] [client 20.249.10.99:15930] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "aSWSzFppQCoYxWW6V0V_DwAAAlQ"]
[Tue Nov 25 19:28:43.114966 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:15839] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aSWS63sB4Gz6Qw-pvBsTWQAAAAI"]
[Tue Nov 25 19:28:44.956774 2025] [:error] [pid 14077:tid 14119] [client 20.249.10.99:15808] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aSWS7BG9n7UHEkwDTyiOhwAAAEk"]
[Tue Nov 25 19:28:46.319951 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:16117] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aSWS7hG9n7UHEkwDTyiOjQAAAFI"]
[Tue Nov 25 19:28:47.183960 2025] [:error] [pid 28842:tid 28999] [client 20.249.10.99:15863] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aSWS79NmoaPf6T4-6C2Q1AAAA0k"]
[Tue Nov 25 19:28:47.907517 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:15859] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "aSWS7yGGdT-nZJVs3x3BogAAAYs"]
[Tue Nov 25 19:28:48.852820 2025] [:error] [pid 28740:tid 28801] [client 20.249.10.99:16076] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "aSWS8FppQCoYxWW6V0V_PwAAAko"]
[Tue Nov 25 19:28:50.401600 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:15834] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "aSWS8pwNRsoxcLQGkTfBOgAAAtY"]
[Tue Nov 25 19:28:52.441105 2025] [:error] [pid 14168:tid 14181] [client 20.249.10.99:15832] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "aSWS9PR-ZDU0QEgAIItlbQAAAMo"]
[Tue Nov 25 19:28:53.673763 2025] [:error] [pid 28842:tid 29001] [client 20.249.10.99:15850] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aSWS9dNmoaPf6T4-6C2Q4QAAA0s"]
[Tue Nov 25 19:28:57.784094 2025] [:error] [pid 14078:tid 14144] [client 20.249.10.99:15826] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aSWS-dVXYbb0ii_rVoJDegAAAIc"]
[Tue Nov 25 19:28:58.211715 2025] [:error] [pid 2987:tid 2989] [client 20.249.10.99:15869] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aSWS-s-djEt-pTzPxnyeWAAAAUA"]
[Tue Nov 25 19:28:59.481970 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:16156] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aSWS-xG9n7UHEkwDTyiOvAAAAEI"]
[Tue Nov 25 19:29:00.376914 2025] [:error] [pid 14077:tid 14124] [client 20.249.10.99:15830] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSWS_BG9n7UHEkwDTyiOwQAAAE4"]
[Tue Nov 25 19:29:01.839572 2025] [:error] [pid 14078:tid 14137] [client 20.249.10.99:15851] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSWS_dVXYbb0ii_rVoJDlQAAAIA"]
[Tue Nov 25 19:29:02.356732 2025] [:error] [pid 2987:tid 2992] [client 20.249.10.99:15810] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSWS_s-djEt-pTzPxnyeWgAAAUM"]
[Tue Nov 25 19:29:04.684128 2025] [:error] [pid 28740:tid 28798] [client 20.249.10.99:15819] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "aSWTAFppQCoYxWW6V0V_TAAAAkc"]
[Tue Nov 25 19:29:05.966039 2025] [:error] [pid 28740:tid 28805] [client 20.249.10.99:15820] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfa.php"] [unique_id "aSWTAVppQCoYxWW6V0V_TwAAAk4"]
[Tue Nov 25 19:29:07.297175 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:16071] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfa.php"] [unique_id "aSWTA9VXYbb0ii_rVoJDmAAAAIE"]
[Tue Nov 25 19:29:08.077243 2025] [:error] [pid 14078:tid 14160] [client 20.249.10.99:15852] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfa.php"] [unique_id "aSWTBNVXYbb0ii_rVoJDmgAAAJc"]
[Tue Nov 25 19:29:08.955711 2025] [:error] [pid 28739:tid 28769] [client 20.249.10.99:15825] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfa.php"] [unique_id "aSWTBBxGpKmlkG4FexR5QwAAAgc"]
[Tue Nov 25 19:29:10.490216 2025] [:error] [pid 14168:tid 14172] [client 20.249.10.99:15858] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/buy.php"] [unique_id "aSWTBvR-ZDU0QEgAIItlcwAAAME"]
[Tue Nov 25 19:29:11.613787 2025] [:error] [pid 14077:tid 14117] [client 20.249.10.99:15814] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/buy.php"] [unique_id "aSWTBxG9n7UHEkwDTyiOzwAAAEc"]
[Tue Nov 25 19:29:12.419381 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:16077] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/buy.php"] [unique_id "aSWTCBG9n7UHEkwDTyiO0QAAAE0"]
[Tue Nov 25 19:29:13.720308 2025] [:error] [pid 14077:tid 14115] [client 20.249.10.99:16066] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/buy.php"] [unique_id "aSWTCRG9n7UHEkwDTyiO1QAAAEU"]
[Tue Nov 25 19:29:15.488670 2025] [:error] [pid 28740:tid 28815] [client 20.249.10.99:16079] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWTC1ppQCoYxWW6V0V_ZwAAAlg"]
[Tue Nov 25 19:29:18.137688 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:15870] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWTDhxGpKmlkG4FexR5TgAAAhg"]
[Tue Nov 25 19:29:19.924882 2025] [:error] [pid 28836:tid 28957] [client 20.249.10.99:15860] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWTD5wNRsoxcLQGkTfBiwAAAsI"]
[Tue Nov 25 19:29:20.776939 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:16099] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWTEBG9n7UHEkwDTyiO6wAAAEI"]
[Tue Nov 25 19:29:24.670750 2025] [:error] [pid 14077:tid 14125] [client 20.249.10.99:16093] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWTFBG9n7UHEkwDTyiO7gAAAE8"]
[Tue Nov 25 19:29:25.876681 2025] [:error] [pid 28842:tid 29000] [client 20.249.10.99:16084] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWTFdNmoaPf6T4-6C2RJAAAA0o"]
[Tue Nov 25 19:29:28.102484 2025] [:error] [pid 28836:tid 28958] [client 20.249.10.99:16070] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWTGJwNRsoxcLQGkTfBjwAAAsM"]
[Tue Nov 25 19:29:28.907895 2025] [:error] [pid 28609:tid 28624] [client 20.249.10.99:15821] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWTGCGGdT-nZJVs3x3BwgAAAYY"]
[Tue Nov 25 19:29:30.300769 2025] [:error] [pid 28842:tid 28998] [client 20.249.10.99:15846] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWTGtNmoaPf6T4-6C2RJQAAA0g"]
[Tue Nov 25 19:29:31.250991 2025] [:error] [pid 14077:tid 14111] [client 20.249.10.99:15847] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWTGxG9n7UHEkwDTyiO-wAAAEE"]
[Tue Nov 25 19:29:34.741853 2025] [:error] [pid 14076:tid 14100] [client 20.249.10.99:15813] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWTHnsB4Gz6Qw-pvBsTugAAABM"]
[Tue Nov 25 19:29:35.968130 2025] [:error] [pid 2987:tid 2992] [client 20.249.10.99:16069] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWTH8-djEt-pTzPxnyeeAAAAUM"]
[Tue Nov 25 19:29:39.122504 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:16085] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWTIxxGpKmlkG4FexR5WwAAAgM"]
[Tue Nov 25 19:29:40.338346 2025] [:error] [pid 14168:tid 14177] [client 20.249.10.99:16065] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWTJPR-ZDU0QEgAIItlkgAAAMY"]
[Tue Nov 25 19:29:41.071308 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:15815] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWTJXsB4Gz6Qw-pvBsTwAAAAAw"]
[Tue Nov 25 19:30:05.082610 2025] [:error] [pid 28739:tid 28767] [client 20.249.10.99:16086] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aSWTPRxGpKmlkG4FexR5nAAAAgU"]
[Tue Nov 25 19:30:08.101910 2025] [:error] [pid 28740:tid 28809] [client 20.249.10.99:16145] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aSWTQFppQCoYxWW6V0V_pgAAAlI"]
[Tue Nov 25 19:30:09.017229 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:15857] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aSWTQZwNRsoxcLQGkTfBtAAAAtY"]
[Tue Nov 25 19:30:10.252005 2025] [:error] [pid 28740:tid 28801] [client 20.249.10.99:16131] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aSWTQlppQCoYxWW6V0V_qgAAAko"]
[Tue Nov 25 19:30:12.546564 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:15848] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWTRBxGpKmlkG4FexR5oQAAAhg"]
[Tue Nov 25 19:30:13.366195 2025] [:error] [pid 28739:tid 28764] [client 20.249.10.99:15854] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWTRRxGpKmlkG4FexR5owAAAgI"]
[Tue Nov 25 19:30:14.516774 2025] [:error] [pid 28842:tid 28993] [client 20.249.10.99:16088] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWTRtNmoaPf6T4-6C2RdAAAA0M"]
[Tue Nov 25 19:30:15.235628 2025] [:error] [pid 28740:tid 28805] [client 20.249.10.99:15829] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "aSWTR1ppQCoYxWW6V0V_rAAAAk4"]
[Tue Nov 25 19:30:16.012611 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:16098] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/link.php"] [unique_id "aSWTSHsB4Gz6Qw-pvBsT0gAAAAI"]
[Tue Nov 25 19:30:16.782120 2025] [:error] [pid 28739:tid 28767] [client 20.249.10.99:16081] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/link.php"] [unique_id "aSWTSBxGpKmlkG4FexR5pQAAAgU"]
[Tue Nov 25 19:30:18.057142 2025] [:error] [pid 28842:tid 28997] [client 20.249.10.99:15837] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/link.php"] [unique_id "aSWTStNmoaPf6T4-6C2RfAAAA0c"]
[Tue Nov 25 19:30:20.123042 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:16078] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/link.php"] [unique_id "aSWTTCGGdT-nZJVs3x3B6wAAAZc"]
[Tue Nov 25 19:30:21.002443 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:15868] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byp.php"] [unique_id "aSWTTXsB4Gz6Qw-pvBsT1wAAAAQ"]
[Tue Nov 25 19:30:21.846795 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:16095] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byp.php"] [unique_id "aSWTTZwNRsoxcLQGkTfBwQAAAtY"]
[Tue Nov 25 19:30:23.056622 2025] [:error] [pid 14168:tid 14189] [client 20.249.10.99:15816] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byp.php"] [unique_id "aSWTT_R-ZDU0QEgAIItlvAAAANI"]
[Tue Nov 25 19:30:23.900030 2025] [:error] [pid 28740:tid 28805] [client 20.249.10.99:15827] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byp.php"] [unique_id "aSWTT1ppQCoYxWW6V0V_twAAAk4"]
[Tue Nov 25 19:30:25.166917 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:16134] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "aSWTURxGpKmlkG4FexR5qwAAAgA"]
[Tue Nov 25 19:30:26.129182 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:16075] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "aSWTUvR-ZDU0QEgAIItlxQAAAM4"]
[Tue Nov 25 19:30:27.702943 2025] [:error] [pid 28836:tid 28968] [client 20.249.10.99:16094] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "aSWTU5wNRsoxcLQGkTfBxQAAAs0"]
[Tue Nov 25 19:30:28.413874 2025] [:error] [pid 2987:tid 2990] [client 20.249.10.99:15845] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "aSWTVM-djEt-pTzPxnyesgAAAUE"]
[Tue Nov 25 19:30:30.603612 2025] [:error] [pid 28740:tid 28806] [client 20.249.10.99:16126] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-trackback.php"] [unique_id "aSWTVlppQCoYxWW6V0V_vAAAAk8"]
[Tue Nov 25 19:30:31.532033 2025] [:error] [pid 14077:tid 14124] [client 20.249.10.99:15836] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-trackback.php"] [unique_id "aSWTVxG9n7UHEkwDTyiPbgAAAE4"]
[Tue Nov 25 19:30:33.314792 2025] [:error] [pid 14076:tid 14092] [client 20.249.10.99:16162] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-trackback.php"] [unique_id "aSWTWXsB4Gz6Qw-pvBsT5AAAAAs"]
[Tue Nov 25 19:30:34.411624 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:16120] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-trackback.php"] [unique_id "aSWTWnsB4Gz6Qw-pvBsT5gAAAAw"]
[Tue Nov 25 19:30:35.428778 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:16080] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/index.php"] [unique_id "aSWTW_R-ZDU0QEgAIItlyAAAAM0"]
[Tue Nov 25 19:30:37.481352 2025] [:error] [pid 14076:tid 14095] [client 20.249.10.99:15840] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/index.php"] [unique_id "aSWTXXsB4Gz6Qw-pvBsT7gAAAA4"]
[Tue Nov 25 19:30:38.049973 2025] [:error] [pid 14076:tid 14097] [client 20.249.10.99:16127] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/index.php"] [unique_id "aSWTXnsB4Gz6Qw-pvBsT9gAAABA"]
[Tue Nov 25 19:30:38.851787 2025] [:error] [pid 28836:tid 28963] [client 20.249.10.99:15862] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/index.php"] [unique_id "aSWTXpwNRsoxcLQGkTfBygAAAsg"]
[Tue Nov 25 19:30:39.838431 2025] [:error] [pid 28842:tid 28990] [client 20.249.10.99:15866] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSWTX9NmoaPf6T4-6C2RnQAAA0A"]
[Tue Nov 25 19:30:41.656134 2025] [:error] [pid 28836:tid 29009] [client 20.249.10.99:16111] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWTYZwNRsoxcLQGkTfBzgAAAtM"]
[Tue Nov 25 19:30:42.751983 2025] [:error] [pid 28740:tid 28800] [client 20.249.10.99:16166] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWTYlppQCoYxWW6V0V_1QAAAkk"]
[Tue Nov 25 19:30:43.777519 2025] [:error] [pid 14168:tid 14186] [client 20.249.10.99:16154] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWTY_R-ZDU0QEgAIItl0QAAAM8"]
[Tue Nov 25 19:30:44.435015 2025] [:error] [pid 14076:tid 14082] [client 20.249.10.99:16097] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWTZHsB4Gz6Qw-pvBsUEQAAAAE"]
[Tue Nov 25 19:30:46.035920 2025] [:error] [pid 14077:tid 14120] [client 20.249.10.99:16068] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWTZhG9n7UHEkwDTyiPigAAAEo"]
[Tue Nov 25 19:30:48.480238 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:15809] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWTaPR-ZDU0QEgAIItl0wAAAMU"]
[Tue Nov 25 19:30:49.583827 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:16174] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWTaXsB4Gz6Qw-pvBsUFQAAAAI"]
[Tue Nov 25 19:30:50.671795 2025] [:error] [pid 28739:tid 28770] [client 20.249.10.99:16118] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "aSWTahxGpKmlkG4FexR5twAAAgg"]
[Tue Nov 25 19:30:51.611110 2025] [:error] [pid 28740:tid 28798] [client 20.249.10.99:16115] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "aSWTa1ppQCoYxWW6V0V_3QAAAkc"]
[Tue Nov 25 19:30:52.547481 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:16087] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "aSWTbBG9n7UHEkwDTyiPkwAAAEI"]
[Tue Nov 25 19:30:56.002106 2025] [:error] [pid 28609:tid 28642] [client 20.249.10.99:15833] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "aSWTcCGGdT-nZJVs3x3CBgAAAZg"]
[Tue Nov 25 19:30:56.909107 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:15822] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSWTcJwNRsoxcLQGkTfB2QAAAsY"]
[Tue Nov 25 19:30:58.225852 2025] [:error] [pid 14077:tid 14114] [client 20.249.10.99:15867] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSWTchG9n7UHEkwDTyiPmwAAAEQ"]
[Tue Nov 25 19:31:00.503786 2025] [:error] [pid 28842:tid 29025] [client 20.249.10.99:16114] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSWTdNNmoaPf6T4-6C2RrgAAA1c"]
[Tue Nov 25 19:31:01.646993 2025] [:error] [pid 28842:tid 28996] [client 20.249.10.99:16164] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gmo.php"] [unique_id "aSWTddNmoaPf6T4-6C2RrwAAA0Y"]
[Tue Nov 25 19:31:03.100846 2025] [:error] [pid 14168:tid 14190] [client 20.249.10.99:16144] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSWTd_R-ZDU0QEgAIItl2AAAANM"]
[Tue Nov 25 19:31:08.653398 2025] [:error] [pid 28740:tid 28791] [client 20.249.10.99:15990] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSWTfFppQCoYxWW6V0V_7gAAAkA"]
[Tue Nov 25 19:31:13.386679 2025] [:error] [pid 14078:tid 14155] [client 20.249.10.99:16146] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSWTgdVXYbb0ii_rVoJEHwAAAJI"]
[Tue Nov 25 19:31:14.856096 2025] [:error] [pid 28836:tid 29013] [client 20.249.10.99:15849] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aSWTgpwNRsoxcLQGkTfB6QAAAtc"]
[Tue Nov 25 19:31:18.590027 2025] [:error] [pid 28836:tid 28962] [client 20.249.10.99:15831] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aSWThpwNRsoxcLQGkTfB7gAAAsc"]
[Tue Nov 25 19:31:19.532286 2025] [:error] [pid 14077:tid 14124] [client 20.249.10.99:15823] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSWThxG9n7UHEkwDTyiPuAAAAE4"]
[Tue Nov 25 19:31:23.231767 2025] [:error] [pid 28609:tid 28618] [client 20.249.10.99:16109] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSWTiyGGdT-nZJVs3x3CGAAAAYA"]
[Tue Nov 25 19:31:25.292218 2025] [proxy_fcgi:error] [pid 28842:tid 29020] [client 20.249.10.99:16104] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 19:31:26.183863 2025] [:error] [pid 28842:tid 29003] [client 20.249.10.99:16104] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "aSWTjtNmoaPf6T4-6C2R0AAAA00"]
[Tue Nov 25 19:31:27.117858 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:15835] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "aSWTj_R-ZDU0QEgAIItl8AAAAM4"]
[Tue Nov 25 19:31:29.373487 2025] [:error] [pid 14078:tid 14151] [client 20.249.10.99:16092] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "aSWTkdVXYbb0ii_rVoJELgAAAI4"]
[Tue Nov 25 19:31:30.581394 2025] [:error] [pid 14076:tid 14096] [client 20.249.10.99:16153] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "aSWTknsB4Gz6Qw-pvBsUPQAAAA8"]
[Tue Nov 25 19:31:31.831007 2025] [:error] [pid 14168:tid 14172] [client 20.249.10.99:16147] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSWTk_R-ZDU0QEgAIItl8wAAAME"]
[Tue Nov 25 19:31:32.918304 2025] [:error] [pid 28842:tid 28997] [client 20.249.10.99:16186] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSWTlNNmoaPf6T4-6C2R1QAAA0c"]
[Tue Nov 25 19:31:34.025184 2025] [:error] [pid 14168:tid 14188] [client 20.249.10.99:16163] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSWTlvR-ZDU0QEgAIItl9gAAANE"]
[Tue Nov 25 19:31:34.620624 2025] [:error] [pid 28842:tid 28993] [client 20.249.10.99:15817] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSWTltNmoaPf6T4-6C2R2AAAA0M"]
[Tue Nov 25 19:31:36.259792 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:16138] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aSWTmBG9n7UHEkwDTyiPzAAAAE0"]
[Tue Nov 25 19:31:37.748235 2025] [:error] [pid 28836:tid 28957] [client 20.249.10.99:15861] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aSWTmZwNRsoxcLQGkTfB-wAAAsI"]
[Tue Nov 25 19:31:38.939913 2025] [:error] [pid 14077:tid 14118] [client 20.249.10.99:16128] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aSWTmhG9n7UHEkwDTyiPzgAAAEg"]
[Tue Nov 25 19:31:39.773537 2025] [:error] [pid 28842:tid 29001] [client 20.249.10.99:15844] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aSWTm9NmoaPf6T4-6C2R3gAAA0s"]
[Tue Nov 25 19:31:41.201713 2025] [:error] [pid 14076:tid 14084] [client 20.249.10.99:15853] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWTnXsB4Gz6Qw-pvBsUSAAAAAM"]
[Tue Nov 25 19:31:42.006643 2025] [:error] [pid 2987:tid 2990] [client 20.249.10.99:16159] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWTns-djEt-pTzPxnye5AAAAUE"]
[Tue Nov 25 19:31:44.087752 2025] [:error] [pid 28739:tid 28775] [client 20.249.10.99:15937] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWToBxGpKmlkG4FexR52wAAAg0"]
[Tue Nov 25 19:31:45.491208 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:16112] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWToSGGdT-nZJVs3x3CMwAAAYw"]
[Tue Nov 25 19:31:47.343621 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:16100] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "aSWTo9VXYbb0ii_rVoJESAAAAIM"]
[Tue Nov 25 19:31:49.356655 2025] [:error] [pid 14077:tid 14110] [client 20.249.10.99:16137] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "aSWTpRG9n7UHEkwDTyiP4wAAAEA"]
[Tue Nov 25 19:31:51.115020 2025] [:error] [pid 14076:tid 14082] [client 20.249.10.99:16096] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "aSWTp3sB4Gz6Qw-pvBsUVwAAAAE"]
[Tue Nov 25 19:31:52.269740 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:16133] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "aSWTqCGGdT-nZJVs3x3COAAAAYs"]
[Tue Nov 25 19:31:53.983947 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:16182] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWTqdVXYbb0ii_rVoJETAAAAIo"]
[Tue Nov 25 19:31:54.930894 2025] [:error] [pid 28740:tid 28813] [client 20.249.10.99:16072] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWTqlppQCoYxWW6V0WAQAAAAlY"]
[Tue Nov 25 19:31:57.022855 2025] [:error] [pid 14168:tid 14194] [client 20.249.10.99:15964] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWTrfR-ZDU0QEgAIItmEgAAANc"]
[Tue Nov 25 19:31:59.184060 2025] [:error] [pid 28836:tid 28965] [client 20.249.10.99:15842] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWTr5wNRsoxcLQGkTfCDAAAAso"]
[Tue Nov 25 19:32:00.902572 2025] [:error] [pid 14076:tid 14092] [client 20.249.10.99:15940] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSWTsHsB4Gz6Qw-pvBsUWwAAAAs"]
[Tue Nov 25 19:32:02.457727 2025] [:error] [pid 28836:tid 29007] [client 20.249.10.99:16107] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/radio.php"] [unique_id "aSWTspwNRsoxcLQGkTfCEAAAAtE"]
[Tue Nov 25 19:32:04.947185 2025] [:error] [pid 28836:tid 28960] [client 20.249.10.99:16073] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/radio.php"] [unique_id "aSWTtJwNRsoxcLQGkTfCEwAAAsU"]
[Tue Nov 25 19:32:06.403346 2025] [:error] [pid 28842:tid 29004] [client 20.249.10.99:16123] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/radio.php"] [unique_id "aSWTttNmoaPf6T4-6C2R9wAAA04"]
[Tue Nov 25 19:32:07.172615 2025] [:error] [pid 2987:tid 2992] [client 20.249.10.99:16180] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/radio.php"] [unique_id "aSWTt8-djEt-pTzPxnye_wAAAUM"]
[Tue Nov 25 19:32:08.818592 2025] [:error] [pid 28739:tid 28768] [client 20.249.10.99:16106] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWTuBxGpKmlkG4FexR56QAAAgY"]
[Tue Nov 25 19:32:11.156686 2025] [:error] [pid 28609:tid 28620] [client 20.249.10.99:15811] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWTuyGGdT-nZJVs3x3CQwAAAYI"]
[Tue Nov 25 19:32:11.932874 2025] [:error] [pid 28739:tid 28784] [client 20.249.10.99:16082] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWTuxxGpKmlkG4FexR57wAAAhY"]
[Tue Nov 25 19:32:13.360426 2025] [:error] [pid 14168:tid 14193] [client 20.249.10.99:15856] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWTvfR-ZDU0QEgAIItmIQAAANY"]
[Tue Nov 25 19:32:15.295046 2025] [:error] [pid 28740:tid 28812] [client 20.249.10.99:15957] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWTv1ppQCoYxWW6V0WAYAAAAlU"]
[Tue Nov 25 19:32:15.942291 2025] [:error] [pid 28740:tid 28799] [client 20.249.10.99:16121] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWTv1ppQCoYxWW6V0WAYQAAAkg"]
[Tue Nov 25 19:32:17.209393 2025] [:error] [pid 28609:tid 28636] [client 20.249.10.99:16110] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWTwSGGdT-nZJVs3x3CSAAAAZI"]
[Tue Nov 25 19:32:18.463773 2025] [:error] [pid 28609:tid 28618] [client 20.249.10.99:16067] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWTwiGGdT-nZJVs3x3CSQAAAYA"]
[Tue Nov 25 19:32:21.033167 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:15950] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSWTxdVXYbb0ii_rVoJEWQAAAIM"]
[Tue Nov 25 19:32:22.657958 2025] [:error] [pid 14077:tid 14111] [client 20.249.10.99:16177] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSWTxhG9n7UHEkwDTyiQAgAAAEE"]
[Tue Nov 25 19:32:24.053419 2025] [:error] [pid 28609:tid 28634] [client 20.249.10.99:16191] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSWTyCGGdT-nZJVs3x3CTQAAAZA"]
[Tue Nov 25 19:32:24.983782 2025] [:error] [pid 28842:tid 28995] [client 20.249.10.99:16168] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/admin.php"] [unique_id "aSWTyNNmoaPf6T4-6C2SEQAAA0U"]
[Tue Nov 25 19:32:36.211039 2025] [:error] [pid 14077:tid 14120] [client 20.249.10.99:15864] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSWT1BG9n7UHEkwDTyiQJgAAAEo"]
[Tue Nov 25 19:32:37.362717 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:16116] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSWT1dVXYbb0ii_rVoJEZAAAAJM"]
[Tue Nov 25 19:32:44.462844 2025] [:error] [pid 2987:tid 2995] [client 20.249.10.99:15824] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kairolin.php"] [unique_id "aSWT3M-djEt-pTzPxnyfLgAAAUY"]
[Tue Nov 25 19:32:46.672538 2025] [:error] [pid 28740:tid 28800] [client 20.249.10.99:15961] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kairolin.php"] [unique_id "aSWT3lppQCoYxWW6V0WAfAAAAkk"]
[Tue Nov 25 19:32:47.824267 2025] [:error] [pid 14077:tid 14133] [client 20.249.10.99:16105] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kairolin.php"] [unique_id "aSWT3xG9n7UHEkwDTyiQNQAAAFc"]
[Tue Nov 25 19:32:49.522771 2025] [:error] [pid 28842:tid 28995] [client 20.249.10.99:16180] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kairolin.php"] [unique_id "aSWT4dNmoaPf6T4-6C2SIAAAA0U"]
[Tue Nov 25 19:32:52.245767 2025] [:error] [pid 2987:tid 3003] [client 20.249.10.99:16181] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/siln.php"] [unique_id "aSWT5M-djEt-pTzPxnyfNgAAAU4"]
[Tue Nov 25 19:32:55.041015 2025] [:error] [pid 28739:tid 28775] [client 20.249.10.99:16136] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/siln.php"] [unique_id "aSWT5xxGpKmlkG4FexR6GgAAAg0"]
[Tue Nov 25 19:32:56.766347 2025] [:error] [pid 28842:tid 29023] [client 20.249.10.99:16158] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/siln.php"] [unique_id "aSWT6NNmoaPf6T4-6C2SNAAAA1U"]
[Tue Nov 25 19:32:57.973524 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:16124] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/siln.php"] [unique_id "aSWT6dVXYbb0ii_rVoJEjAAAAIk"]
[Tue Nov 25 23:22:39.689474 2025] [:error] [pid 28609:tid 28627] [client 98.89.29.83:41736] [client 98.89.29.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aSXJvyGGdT-nZJVs3x0NkAAAAYk"]
[Tue Nov 25 23:44:39.168335 2025] [:error] [pid 2987:tid 3009] [client 139.59.30.253:59730] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/"] [unique_id "aSXO58-djEt-pTzPxnztjwAAAVQ"], referer: binance.com
[Wed Nov 26 03:14:57.252480 2025] [:error] [pid 47045:tid 47107] [client 54.173.250.15:58574] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aSYAMRsL_waSUMFH0J71ugAAAFM"]
[Wed Nov 26 03:21:07.411347 2025] [:error] [pid 19664:tid 19724] [client 67.23.254.96:44628] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.23.254.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSYBo4HU6yUQwaQ4jb1j7gAAAIQ"]
[Wed Nov 26 03:21:10.531609 2025] [:error] [pid 19664:tid 19730] [client 67.23.254.96:35788] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.23.254.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSYBpoHU6yUQwaQ4jb1j8wAAAIo"]
[Wed Nov 26 03:21:13.166454 2025] [:error] [pid 19663:tid 19706] [client 67.23.254.96:35806] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.23.254.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSYBqfS2Sja6sKmijylszwAAAE0"]
[Wed Nov 26 05:01:27.450950 2025] [:error] [pid 3097:tid 3125] [client 45.3.41.60:55823] [client 45.3.41.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "aSYZJ-VgdOH9N9jhT56HfQAAANg"]
[Wed Nov 26 05:01:30.626609 2025] [:error] [pid 3011:tid 3045] [client 45.3.44.28:10609] [client 45.3.44.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aSYZKkb0BA3GljiGlI65xgAAAEM"]
[Wed Nov 26 05:01:32.317021 2025] [:error] [pid 3097:tid 3121] [client 45.3.42.239:37075] [client 45.3.42.239] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.svn/wc.db"] [unique_id "aSYZLOVgdOH9N9jhT56HhwAAANQ"]
[Wed Nov 26 07:03:56.219684 2025] [:error] [pid 3011:tid 3046] [client 203.33.203.148:47125] [client 203.33.203.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aSY13Eb0BA3GljiGlI7bVAAAAEQ"]
[Wed Nov 26 11:42:41.875122 2025] [:error] [pid 45901:tid 45904] [client 162.241.216.173:17462] [client 162.241.216.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.216.173, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSZ3MSunQ1SpfPRNrtyM0gAAAQE"]
[Wed Nov 26 11:42:44.277927 2025] [:error] [pid 10383:tid 10405] [client 162.241.216.173:43930] [client 162.241.216.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.216.173, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSZ3NK0RJ-zjhOVjD8-oyAAAAdM"]
[Wed Nov 26 11:42:46.489269 2025] [:error] [pid 35540:tid 35546] [client 162.241.216.173:43954] [client 162.241.216.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.216.173, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSZ3NsGrIq2A6SZSnkJW7gAAAIA"]
[Wed Nov 26 13:17:28.637369 2025] [:error] [pid 45836:tid 45849] [client 111.172.249.49:35660] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSaNaJfrnOGqL-seZAw48gAAAMM"]
[Wed Nov 26 13:58:18.398854 2025] [:error] [pid 35540:tid 35569] [client 74.113.250.38:54360] [client 74.113.250.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.113.250.38, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSaW-sGrIq2A6SZSnkJ_vAAAAJc"]
[Wed Nov 26 13:58:22.411652 2025] [:error] [pid 34830:tid 34835] [client 74.113.250.38:57144] [client 74.113.250.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.113.250.38, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSaW_kukvkWgWN6jCR2p9QAAAAM"]
[Wed Nov 26 13:58:26.408763 2025] [:error] [pid 10383:tid 10410] [client 74.113.250.38:57172] [client 74.113.250.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.113.250.38, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSaXAq0RJ-zjhOVjD8_VcAAAAdg"]
[Wed Nov 26 19:41:53.956326 2025] [:error] [pid 46443:tid 46457] [client 3.107.8.159:46152] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aSbngcLmDsnHrj-QFB_nxwAAAEw"]
[Wed Nov 26 19:41:54.010997 2025] [:error] [pid 46443:tid 46461] [client 3.107.8.159:46158] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "aSbngsLmDsnHrj-QFB_nyAAAAFA"]
[Wed Nov 26 19:41:54.073081 2025] [:error] [pid 45684:tid 45726] [client 3.107.8.159:46162] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.local"] [unique_id "aSbngvg5LMxwI4-PD1dSYgAAAAs"]
[Wed Nov 26 19:41:54.142283 2025] [:error] [pid 20733:tid 20755] [client 3.107.8.159:46166] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.dev"] [unique_id "aSbnggV9EP2HuRvnH8dbFAAAANQ"]
[Wed Nov 26 19:41:54.206944 2025] [:error] [pid 20733:tid 20737] [client 3.107.8.159:46170] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.prod"] [unique_id "aSbnggV9EP2HuRvnH8dbFQAAAMI"]
[Wed Nov 26 19:41:54.266186 2025] [:error] [pid 45684:tid 45724] [client 3.107.8.159:46186] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.staging"] [unique_id "aSbngvg5LMxwI4-PD1dSYwAAAAk"]
[Wed Nov 26 19:41:54.323423 2025] [:error] [pid 20733:tid 20754] [client 3.107.8.159:46196] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.development"] [unique_id "aSbnggV9EP2HuRvnH8dbFgAAANM"]
[Wed Nov 26 19:41:54.384476 2025] [:error] [pid 45684:tid 45722] [client 3.107.8.159:51394] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.production"] [unique_id "aSbngvg5LMxwI4-PD1dSZAAAAAc"]
[Wed Nov 26 19:41:54.447286 2025] [:error] [pid 45684:tid 45739] [client 3.107.8.159:51408] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.test"] [unique_id "aSbngvg5LMxwI4-PD1dSZQAAABg"]
[Wed Nov 26 19:41:54.509604 2025] [:error] [pid 45684:tid 45727] [client 3.107.8.159:51422] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.backup"] [unique_id "aSbngvg5LMxwI4-PD1dSZgAAAAw"]
[Wed Nov 26 19:41:54.568618 2025] [:error] [pid 46443:tid 46451] [client 3.107.8.159:51434] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env~"] [unique_id "aSbngsLmDsnHrj-QFB_nyQAAAEY"]
[Wed Nov 26 19:41:54.630566 2025] [:error] [pid 20733:tid 20746] [client 3.107.8.159:51450] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.sample"] [unique_id "aSbnggV9EP2HuRvnH8dbFwAAAMs"]
[Wed Nov 26 19:41:54.690894 2025] [:error] [pid 45769:tid 45788] [client 3.107.8.159:51464] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.old"] [unique_id "aSbngldG5Eht9c3yy4MoOQAAAdA"]
[Wed Nov 26 19:41:54.750911 2025] [:error] [pid 20733:tid 20744] [client 3.107.8.159:51474] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.bak"] [unique_id "aSbnggV9EP2HuRvnH8dbGAAAAMk"]
[Wed Nov 26 19:41:54.811987 2025] [:error] [pid 20733:tid 20735] [client 3.107.8.159:51488] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.save"] [unique_id "aSbnggV9EP2HuRvnH8dbGQAAAMA"]
[Wed Nov 26 19:41:54.877381 2025] [:error] [pid 45769:tid 45781] [client 3.107.8.159:51490] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.orig"] [unique_id "aSbngldG5Eht9c3yy4MoOgAAAck"]
[Wed Nov 26 19:41:54.937220 2025] [:error] [pid 20733:tid 20749] [client 3.107.8.159:51494] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.swp"] [unique_id "aSbnggV9EP2HuRvnH8dbGgAAAM4"]
[Wed Nov 26 19:41:55.017381 2025] [:error] [pid 6471:tid 6491] [client 3.107.8.159:51504] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.tmp"] [unique_id "aSbng-h3Z9TZLlRuTiOT8gAAAJE"]
[Wed Nov 26 19:41:55.072633 2025] [:error] [pid 46443:tid 46448] [client 3.107.8.159:51510] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.dist"] [unique_id "aSbng8LmDsnHrj-QFB_nzAAAAEM"]
[Wed Nov 26 19:41:55.134745 2025] [:error] [pid 46443:tid 46468] [client 3.107.8.159:51516] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/admin/.env"] [unique_id "aSbng8LmDsnHrj-QFB_nzQAAAFc"]
[Wed Nov 26 19:41:55.205665 2025] [:error] [pid 20733:tid 20753] [client 3.107.8.159:51530] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/admin/.env.save"] [unique_id "aSbngwV9EP2HuRvnH8dbGwAAANI"]
[Wed Nov 26 19:41:55.263717 2025] [:error] [pid 20733:tid 20742] [client 3.107.8.159:51534] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/admin/.env.bak"] [unique_id "aSbngwV9EP2HuRvnH8dbHAAAAMc"]
[Wed Nov 26 19:41:55.319799 2025] [:error] [pid 45769:tid 45774] [client 3.107.8.159:51542] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/admin/.env.old"] [unique_id "aSbng1dG5Eht9c3yy4MoOwAAAcI"]
[Wed Nov 26 19:41:55.385928 2025] [:error] [pid 45683:tid 45707] [client 3.107.8.159:51544] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/api/.env"] [unique_id "aSbngxX1gQgNFW_222qvDwAAAVM"]
[Wed Nov 26 19:41:55.443734 2025] [:error] [pid 45769:tid 45775] [client 3.107.8.159:51552] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/api/.env.save"] [unique_id "aSbng1dG5Eht9c3yy4MoPAAAAcM"]
[Wed Nov 26 19:41:55.502285 2025] [:error] [pid 45683:tid 45701] [client 3.107.8.159:51568] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/api/.env.bak"] [unique_id "aSbngxX1gQgNFW_222qvEAAAAU0"]
[Wed Nov 26 19:41:55.566513 2025] [:error] [pid 45684:tid 45734] [client 3.107.8.159:51572] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/api/.env.old"] [unique_id "aSbng_g5LMxwI4-PD1dSaAAAABM"]
[Wed Nov 26 19:41:55.630204 2025] [:error] [pid 45685:tid 45745] [client 3.107.8.159:51574] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/app/.env"] [unique_id "aSbng1j3f_NRdgU0DQ7dawAAAQM"]
[Wed Nov 26 19:41:55.685429 2025] [:error] [pid 46443:tid 46447] [client 3.107.8.159:51582] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/app/.env.save"] [unique_id "aSbng8LmDsnHrj-QFB_nzgAAAEI"]
[Wed Nov 26 19:41:55.745115 2025] [:error] [pid 45684:tid 45731] [client 3.107.8.159:51588] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/app/.env.bak"] [unique_id "aSbng_g5LMxwI4-PD1dSaQAAABA"]
[Wed Nov 26 19:41:55.801999 2025] [:error] [pid 45684:tid 45717] [client 3.107.8.159:51598] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/app/.env.old"] [unique_id "aSbng_g5LMxwI4-PD1dSagAAAAI"]
[Wed Nov 26 19:41:55.862671 2025] [:error] [pid 45685:tid 45764] [client 3.107.8.159:51608] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/config/.env"] [unique_id "aSbng1j3f_NRdgU0DQ7dbAAAARY"]
[Wed Nov 26 19:41:55.927631 2025] [:error] [pid 46443:tid 46454] [client 3.107.8.159:51612] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/config/.env.save"] [unique_id "aSbng8LmDsnHrj-QFB_nzwAAAEk"]
[Wed Nov 26 19:41:55.983363 2025] [:error] [pid 45683:tid 45705] [client 3.107.8.159:51628] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/config/.env.bak"] [unique_id "aSbngxX1gQgNFW_222qvEQAAAVE"]
[Wed Nov 26 19:41:56.044141 2025] [:error] [pid 46443:tid 46456] [client 3.107.8.159:51630] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/config/.env.old"] [unique_id "aSbnhMLmDsnHrj-QFB_n0AAAAEs"]
[Wed Nov 26 19:41:56.101506 2025] [:error] [pid 45684:tid 45721] [client 3.107.8.159:51640] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/src/.env"] [unique_id "aSbnhPg5LMxwI4-PD1dSawAAAAY"]
[Wed Nov 26 19:41:56.164243 2025] [:error] [pid 46443:tid 46459] [client 3.107.8.159:51656] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/src/.env.save"] [unique_id "aSbnhMLmDsnHrj-QFB_n0QAAAE4"]
[Wed Nov 26 19:41:56.223315 2025] [:error] [pid 45684:tid 45729] [client 3.107.8.159:51672] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/src/.env.bak"] [unique_id "aSbnhPg5LMxwI4-PD1dSbAAAAA4"]
[Wed Nov 26 19:41:56.281733 2025] [:error] [pid 46443:tid 46461] [client 3.107.8.159:51680] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/src/.env.old"] [unique_id "aSbnhMLmDsnHrj-QFB_n0gAAAFA"]
[Wed Nov 26 19:41:56.339533 2025] [:error] [pid 45684:tid 45732] [client 3.107.8.159:51692] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/public/.env"] [unique_id "aSbnhPg5LMxwI4-PD1dSbQAAABE"]
[Wed Nov 26 19:41:56.393217 2025] [:error] [pid 46443:tid 46451] [client 3.107.8.159:51698] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/public/.env.save"] [unique_id "aSbnhMLmDsnHrj-QFB_n0wAAAEY"]
[Wed Nov 26 19:41:56.454383 2025] [:error] [pid 46443:tid 46446] [client 3.107.8.159:51706] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/public/.env.bak"] [unique_id "aSbnhMLmDsnHrj-QFB_n1AAAAEE"]
[Wed Nov 26 19:41:56.509262 2025] [:error] [pid 46443:tid 46468] [client 3.107.8.159:51708] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/public/.env.old"] [unique_id "aSbnhMLmDsnHrj-QFB_n1QAAAFc"]
[Wed Nov 26 19:41:56.565672 2025] [:error] [pid 45684:tid 45726] [client 3.107.8.159:51710] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/assets/.env"] [unique_id "aSbnhPg5LMxwI4-PD1dSbgAAAAs"]
[Wed Nov 26 19:41:56.627949 2025] [:error] [pid 46443:tid 46458] [client 3.107.8.159:51726] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/assets/.env.save"] [unique_id "aSbnhMLmDsnHrj-QFB_n1gAAAE0"]
[Wed Nov 26 19:41:56.684511 2025] [:error] [pid 46443:tid 46447] [client 3.107.8.159:51732] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/assets/.env.bak"] [unique_id "aSbnhMLmDsnHrj-QFB_n1wAAAEI"]
[Wed Nov 26 19:41:56.741046 2025] [:error] [pid 46443:tid 46456] [client 3.107.8.159:51748] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/assets/.env.old"] [unique_id "aSbnhMLmDsnHrj-QFB_n2AAAAEs"]
[Wed Nov 26 19:41:56.795509 2025] [:error] [pid 46443:tid 46457] [client 3.107.8.159:51758] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/includes/.env"] [unique_id "aSbnhMLmDsnHrj-QFB_n2QAAAEw"]
[Wed Nov 26 19:41:56.853956 2025] [:error] [pid 46443:tid 46461] [client 3.107.8.159:51762] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/includes/.env.save"] [unique_id "aSbnhMLmDsnHrj-QFB_n2gAAAFA"]
[Wed Nov 26 19:41:56.915873 2025] [:error] [pid 45683:tid 45688] [client 3.107.8.159:51766] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/includes/.env.bak"] [unique_id "aSbnhBX1gQgNFW_222qvEgAAAUA"]
[Wed Nov 26 19:41:56.978758 2025] [:error] [pid 46443:tid 46463] [client 3.107.8.159:51770] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/includes/.env.old"] [unique_id "aSbnhMLmDsnHrj-QFB_n2wAAAFI"]
[Wed Nov 26 19:41:57.034963 2025] [:error] [pid 46443:tid 46451] [client 3.107.8.159:51782] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/lib/.env"] [unique_id "aSbnhcLmDsnHrj-QFB_n3AAAAEY"]
[Wed Nov 26 19:41:57.093377 2025] [:error] [pid 46443:tid 46452] [client 3.107.8.159:51786] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/lib/.env.save"] [unique_id "aSbnhcLmDsnHrj-QFB_n3QAAAEc"]
[Wed Nov 26 19:41:57.153678 2025] [:error] [pid 45769:tid 45782] [client 3.107.8.159:51796] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/lib/.env.bak"] [unique_id "aSbnhVdG5Eht9c3yy4MoPwAAAco"]
[Wed Nov 26 19:41:57.210761 2025] [:error] [pid 46443:tid 46446] [client 3.107.8.159:51812] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/lib/.env.old"] [unique_id "aSbnhcLmDsnHrj-QFB_n3wAAAEE"]
[Wed Nov 26 19:41:57.274484 2025] [:error] [pid 46443:tid 46468] [client 3.107.8.159:51824] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/application/.env"] [unique_id "aSbnhcLmDsnHrj-QFB_n4AAAAFc"]
[Wed Nov 26 19:41:57.336200 2025] [:error] [pid 45683:tid 45690] [client 3.107.8.159:51836] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/application/.env.save"] [unique_id "aSbnhRX1gQgNFW_222qvFAAAAUI"]
[Wed Nov 26 19:41:57.400328 2025] [:error] [pid 46443:tid 46458] [client 3.107.8.159:51842] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/application/.env.bak"] [unique_id "aSbnhcLmDsnHrj-QFB_n4QAAAE0"]
[Wed Nov 26 19:41:57.460509 2025] [:error] [pid 46443:tid 46449] [client 3.107.8.159:51850] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/application/.env.old"] [unique_id "aSbnhcLmDsnHrj-QFB_n4gAAAEQ"]
[Wed Nov 26 19:41:57.529832 2025] [:error] [pid 45684:tid 45724] [client 3.107.8.159:51862] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/system/.env"] [unique_id "aSbnhfg5LMxwI4-PD1dSbwAAAAk"]
[Wed Nov 26 19:41:57.587465 2025] [:error] [pid 45685:tid 45754] [client 3.107.8.159:51872] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/system/.env.save"] [unique_id "aSbnhVj3f_NRdgU0DQ7dbQAAAQw"]
[Wed Nov 26 19:41:57.644315 2025] [:error] [pid 45685:tid 45762] [client 3.107.8.159:51886] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/system/.env.bak"] [unique_id "aSbnhVj3f_NRdgU0DQ7dbgAAARQ"]
[Wed Nov 26 19:41:57.700946 2025] [:error] [pid 45684:tid 45728] [client 3.107.8.159:51898] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/system/.env.old"] [unique_id "aSbnhfg5LMxwI4-PD1dScAAAAA0"]
[Wed Nov 26 19:41:57.760651 2025] [:error] [pid 45684:tid 45715] [client 3.107.8.159:51914] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/core/.env"] [unique_id "aSbnhfg5LMxwI4-PD1dScQAAAAA"]
[Wed Nov 26 19:41:57.818654 2025] [:error] [pid 45683:tid 45700] [client 3.107.8.159:51924] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/core/.env.save"] [unique_id "aSbnhRX1gQgNFW_222qvFQAAAUw"]
[Wed Nov 26 19:41:57.878644 2025] [:error] [pid 45683:tid 45706] [client 3.107.8.159:51926] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/core/.env.bak"] [unique_id "aSbnhRX1gQgNFW_222qvFgAAAVI"]
[Wed Nov 26 19:41:57.934748 2025] [:error] [pid 45683:tid 45703] [client 3.107.8.159:51942] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/core/.env.old"] [unique_id "aSbnhRX1gQgNFW_222qvFwAAAU8"]
[Wed Nov 26 19:41:57.993964 2025] [:error] [pid 46443:tid 46447] [client 3.107.8.159:51948] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/modules/.env"] [unique_id "aSbnhcLmDsnHrj-QFB_n4wAAAEI"]
[Wed Nov 26 19:41:58.053032 2025] [:error] [pid 45769:tid 45791] [client 3.107.8.159:51962] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/modules/.env.save"] [unique_id "aSbnhldG5Eht9c3yy4MoQAAAAdM"]
[Wed Nov 26 19:41:58.116056 2025] [:error] [pid 46443:tid 46456] [client 3.107.8.159:51968] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/modules/.env.bak"] [unique_id "aSbnhsLmDsnHrj-QFB_n5AAAAEs"]
[Wed Nov 26 19:41:58.178358 2025] [:error] [pid 46443:tid 46457] [client 3.107.8.159:51978] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/modules/.env.old"] [unique_id "aSbnhsLmDsnHrj-QFB_n5QAAAEw"]
[Wed Nov 26 19:41:58.240489 2025] [:error] [pid 46443:tid 46461] [client 3.107.8.159:51988] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/plugins/.env"] [unique_id "aSbnhsLmDsnHrj-QFB_n5gAAAFA"]
[Wed Nov 26 19:41:58.300017 2025] [:error] [pid 46443:tid 46463] [client 3.107.8.159:51998] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/plugins/.env.save"] [unique_id "aSbnhsLmDsnHrj-QFB_n5wAAAFI"]
[Wed Nov 26 19:41:58.366786 2025] [:error] [pid 46443:tid 46451] [client 3.107.8.159:52006] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/plugins/.env.bak"] [unique_id "aSbnhsLmDsnHrj-QFB_n6AAAAEY"]
[Wed Nov 26 19:41:58.433646 2025] [:error] [pid 20733:tid 20745] [client 3.107.8.159:52020] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/plugins/.env.old"] [unique_id "aSbnhgV9EP2HuRvnH8dbIAAAAMo"]
[Wed Nov 26 19:41:58.500692 2025] [:error] [pid 20733:tid 20755] [client 3.107.8.159:52026] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/themes/.env"] [unique_id "aSbnhgV9EP2HuRvnH8dbIQAAANQ"]
[Wed Nov 26 19:41:58.559755 2025] [:error] [pid 6471:tid 6498] [client 3.107.8.159:52034] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/themes/.env.save"] [unique_id "aSbnhuh3Z9TZLlRuTiOT9AAAAJg"]
[Wed Nov 26 19:41:58.616417 2025] [:error] [pid 6471:tid 6476] [client 3.107.8.159:52048] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/themes/.env.bak"] [unique_id "aSbnhuh3Z9TZLlRuTiOT9QAAAII"]
[Wed Nov 26 19:41:58.674069 2025] [:error] [pid 6471:tid 6495] [client 3.107.8.159:52060] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/themes/.env.old"] [unique_id "aSbnhuh3Z9TZLlRuTiOT9gAAAJU"]
[Wed Nov 26 19:41:58.733483 2025] [:error] [pid 20733:tid 20737] [client 3.107.8.159:52074] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/vendor/.env"] [unique_id "aSbnhgV9EP2HuRvnH8dbIgAAAMI"]
[Wed Nov 26 19:41:58.791862 2025] [:error] [pid 45683:tid 45702] [client 3.107.8.159:52082] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/vendor/.env.save"] [unique_id "aSbnhhX1gQgNFW_222qvGAAAAU4"]
[Wed Nov 26 19:41:58.859482 2025] [:error] [pid 45683:tid 45699] [client 3.107.8.159:52098] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/vendor/.env.bak"] [unique_id "aSbnhhX1gQgNFW_222qvGQAAAUs"]
[Wed Nov 26 19:41:58.927331 2025] [:error] [pid 45683:tid 45696] [client 3.107.8.159:52114] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/vendor/.env.old"] [unique_id "aSbnhhX1gQgNFW_222qvGgAAAUg"]
[Wed Nov 26 19:41:58.985036 2025] [:error] [pid 46443:tid 46452] [client 3.107.8.159:52126] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/storage/.env"] [unique_id "aSbnhsLmDsnHrj-QFB_n6QAAAEc"]
[Wed Nov 26 19:41:59.045344 2025] [:error] [pid 6471:tid 6490] [client 3.107.8.159:52130] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/storage/.env.save"] [unique_id "aSbnh-h3Z9TZLlRuTiOT-AAAAJA"]
[Wed Nov 26 19:41:59.104400 2025] [:error] [pid 45685:tid 45750] [client 3.107.8.159:52142] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/storage/.env.bak"] [unique_id "aSbnh1j3f_NRdgU0DQ7dcAAAAQg"]
[Wed Nov 26 19:41:59.162999 2025] [:error] [pid 45684:tid 45738] [client 3.107.8.159:52144] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/storage/.env.old"] [unique_id "aSbnh_g5LMxwI4-PD1dScgAAABc"]
[Wed Nov 26 19:42:00.702113 2025] [:error] [pid 6471:tid 6480] [client 3.107.8.159:52360] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/phpinfo.php.bak"] [unique_id "aSbniOh3Z9TZLlRuTiOT_QAAAIY"]
[Wed Nov 26 19:42:00.767446 2025] [:error] [pid 20733:tid 20735] [client 3.107.8.159:52372] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/info.php.bak"] [unique_id "aSbniAV9EP2HuRvnH8dbJgAAAMA"]
[Wed Nov 26 19:42:00.826460 2025] [:error] [pid 45685:tid 45751] [client 3.107.8.159:52382] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/php_info.php.bak"] [unique_id "aSbniFj3f_NRdgU0DQ7dcgAAAQk"]
[Wed Nov 26 19:42:00.891258 2025] [:error] [pid 45684:tid 45717] [client 3.107.8.159:52392] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/test.php.bak"] [unique_id "aSbniPg5LMxwI4-PD1dSdQAAAAI"]
[Wed Nov 26 19:42:00.950845 2025] [:error] [pid 6471:tid 6494] [client 3.107.8.159:52406] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/phpinfo.php.old"] [unique_id "aSbniOh3Z9TZLlRuTiOT_gAAAJQ"]
[Wed Nov 26 19:42:01.014745 2025] [:error] [pid 45683:tid 45698] [client 3.107.8.159:52408] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/info.php.old"] [unique_id "aSbniRX1gQgNFW_222qvHwAAAUo"]
[Wed Nov 26 19:42:01.078418 2025] [:error] [pid 20733:tid 20749] [client 3.107.8.159:52416] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/php_info.php.old"] [unique_id "aSbniQV9EP2HuRvnH8dbJwAAAM4"]
[Wed Nov 26 19:42:01.144037 2025] [:error] [pid 45685:tid 45766] [client 3.107.8.159:52418] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/test.php.old"] [unique_id "aSbniVj3f_NRdgU0DQ7dcwAAARg"]
[Wed Nov 26 19:42:01.467452 2025] [:error] [pid 45685:tid 45755] [client 3.107.8.159:52470] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/phpinfo.php.backup"] [unique_id "aSbniVj3f_NRdgU0DQ7ddQAAAQ0"]
[Wed Nov 26 19:42:01.529969 2025] [:error] [pid 46443:tid 46462] [client 3.107.8.159:52480] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/info.php.backup"] [unique_id "aSbnicLmDsnHrj-QFB_n8AAAAFE"]
[Wed Nov 26 19:42:01.594406 2025] [:error] [pid 45685:tid 45747] [client 3.107.8.159:52488] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/php_info.php.backup"] [unique_id "aSbniVj3f_NRdgU0DQ7ddwAAAQU"]
[Wed Nov 26 19:42:01.654647 2025] [:error] [pid 20733:tid 20748] [client 3.107.8.159:52492] [client 3.107.8.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/test.php.backup"] [unique_id "aSbniQV9EP2HuRvnH8dbKAAAAM0"]
[Wed Nov 26 23:08:14.463026 2025] [:error] [pid 46443:tid 46458] [client 216.126.239.203:35580] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aScX3sLmDsnHrj-QFB8omAAAAE0"]
[Wed Nov 26 23:42:11.738105 2025] [:error] [pid 20733:tid 20748] [client 34.80.26.96:33478] [client 34.80.26.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.80.26.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aScf0wV9EP2HuRvnH8eLMgAAAM0"]
[Wed Nov 26 23:42:14.044164 2025] [:error] [pid 45683:tid 45706] [client 34.80.26.96:46406] [client 34.80.26.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.80.26.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aScf1hX1gQgNFW_222rkyQAAAVI"]
[Wed Nov 26 23:42:16.252581 2025] [:error] [pid 45769:tid 45794] [client 34.80.26.96:46860] [client 34.80.26.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.80.26.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aScf2FdG5Eht9c3yy4NXkwAAAdY"]
[Thu Nov 27 00:35:12.716244 2025] [:error] [pid 25262:tid 25329] [client 159.223.81.247:49200] [client 159.223.81.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.81.247, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aScsQE3p81VU3bYILBU4lgAAAgg"], referer: http://paramountestate.com
[Thu Nov 27 00:48:51.644417 2025] [:error] [pid 8184:tid 8260] [client 77.222.43.160:15998] [client 77.222.43.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.222.43.160, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aScvc7-M2IHkRYVrcbN5eAAAAFY"], referer: http://paramountestate.com
[Thu Nov 27 00:54:45.202122 2025] [:error] [pid 25180:tid 25203] [client 103.77.107.57:61322] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "aScw1b-owhtiwMHXYlzQOgAAAZU"]
[Thu Nov 27 00:54:45.446666 2025] [:error] [pid 25180:tid 25192] [client 103.77.107.57:57110] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.vscode/sftp.json"] [unique_id "aScw1b-owhtiwMHXYlzQPAAAAYo"]
[Thu Nov 27 00:59:06.819713 2025] [:error] [pid 54723:tid 54742] [client 98.142.97.74:53098] [client 98.142.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.142.97.74, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aScx2g2CEg7QoyDosdL0OwAAAAw"], referer: http://paramountestate.com
[Thu Nov 27 01:20:41.853121 2025] [:error] [pid 54723:tid 54754] [client 193.164.17.45:35466] [client 193.164.17.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.164.17.45, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSc26Q2CEg7QoyDosdL5cwAAABg"], referer: http://paramountestate.com
[Thu Nov 27 01:24:03.248894 2025] [:error] [pid 54723:tid 54739] [client 176.126.165.66:38096] [client 176.126.165.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.126.165.66, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSc3sw2CEg7QoyDosdL6gQAAAAk"], referer: http://paramountestate.com
[Thu Nov 27 01:30:59.596770 2025] [:error] [pid 8184:tid 8245] [client 163.5.109.117:53104] [client 163.5.109.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.109.117, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSc5U7-M2IHkRYVrcbOIZgAAAEg"], referer: http://paramountestate.com
[Thu Nov 27 01:37:51.938620 2025] [:error] [pid 8184:tid 8237] [client 77.222.62.198:42154] [client 77.222.62.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.222.62.198, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSc677-M2IHkRYVrcbOK0QAAAEE"], referer: http://paramountestate.com
[Thu Nov 27 01:38:39.208326 2025] [:error] [pid 8184:tid 8260] [client 20.122.96.187:4219] [client 20.122.96.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.122.96.187, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSc7H7-M2IHkRYVrcbOK8AAAAFY"], referer: https://www.google.de/
[Thu Nov 27 01:41:15.431011 2025] [:error] [pid 25262:tid 25329] [client 82.221.129.40:52360] [client 82.221.129.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.221.129.40, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSc7u03p81VU3bYILBVGvgAAAgg"], referer: http://paramountestate.com
[Thu Nov 27 01:41:17.740193 2025] [:error] [pid 24814:tid 25077] [client 20.122.96.187:6013] [client 20.122.96.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "aSc7vQPn1NMGCdo6RsiqBwAAAUI"], referer: https://www.yahoo.com/
[Thu Nov 27 02:02:59.487431 2025] [:error] [pid 25262:tid 25328] [client 103.21.220.244:53338] [client 103.21.220.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.21.220.244, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdA003p81VU3bYILBVNWAAAAgc"], referer: http://paramountestate.com
[Thu Nov 27 02:06:37.662768 2025] [:error] [pid 24826:tid 25122] [client 176.88.180.248:55388] [client 176.88.180.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.88.180.248, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdBrVEvPXLVl-nh-yLrnAAAAQc"], referer: http://paramountestate.com
[Thu Nov 27 02:14:05.482120 2025] [:error] [pid 24814:tid 25098] [client 78.111.87.202:45578] [client 78.111.87.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.111.87.202, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdDbQPn1NMGCdo6RsivrwAAAVc"], referer: http://paramountestate.com
[Thu Nov 27 02:17:42.331063 2025] [:error] [pid 8184:tid 8245] [client 152.42.202.97:34752] [client 152.42.202.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.202.97, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdERr-M2IHkRYVrcbOZ2gAAAEg"], referer: http://paramountestate.com
[Thu Nov 27 02:21:22.805314 2025] [:error] [pid 24826:tid 25134] [client 13.40.65.124:55630] [client 13.40.65.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.40.65.124, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdFIlEvPXLVl-nh-yLufgAAARI"], referer: http://paramountestate.com
[Thu Nov 27 02:25:05.360914 2025] [:error] [pid 24826:tid 25116] [client 176.126.165.66:45446] [client 176.126.165.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.126.165.66, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdGAVEvPXLVl-nh-yLu4AAAAQE"], referer: http://paramountestate.com
[Thu Nov 27 02:32:18.567164 2025] [:error] [pid 54723:tid 54743] [client 182.42.111.156:54296] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aSdHsg2CEg7QoyDosdILQQAAAA0"]
[Thu Nov 27 02:32:50.189702 2025] [:error] [pid 8184:tid 8240] [client 45.156.185.91:33244] [client 45.156.185.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.156.185.91, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdH0r-M2IHkRYVrcbOeyAAAAEQ"], referer: http://paramountestate.com
[Thu Nov 27 02:39:49.235707 2025] [:error] [pid 8184:tid 8255] [client 194.163.153.255:34724] [client 194.163.153.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.153.255, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdJdb-M2IHkRYVrcbOh3QAAAFE"], referer: http://paramountestate.com
[Thu Nov 27 02:50:02.115720 2025] [:error] [pid 25262:tid 25342] [client 202.182.100.52:45414] [client 202.182.100.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.182.100.52, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdL2k3p81VU3bYILBVW4wAAAhU"], referer: http://paramountestate.com
[Thu Nov 27 02:53:22.663436 2025] [:error] [pid 25180:tid 25196] [client 45.145.67.141:41960] [client 45.145.67.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.145.67.141, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdMor-owhtiwMHXYlzqAAAAAY4"], referer: http://paramountestate.com
[Thu Nov 27 03:00:02.409211 2025] [:error] [pid 24826:tid 25139] [client 163.5.109.117:33284] [client 163.5.109.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.109.117, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdOMlEvPXLVl-nh-yL2KwAAARc"], referer: http://paramountestate.com
[Thu Nov 27 03:03:31.838965 2025] [:error] [pid 24826:tid 25134] [client 186.250.243.195:51938] [client 186.250.243.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.250.243.195, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdPA1EvPXLVl-nh-yL3AwAAARI"], referer: http://paramountestate.com
[Thu Nov 27 03:32:40.381919 2025] [:error] [pid 22671:tid 22742] [client 45.156.185.91:41746] [client 45.156.185.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.156.185.91, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdV2Po1hytoWehyQ0Dd4AAAAIg"], referer: http://paramountestate.com
[Thu Nov 27 03:53:00.605340 2025] [:error] [pid 6290:tid 6294] [client 162.0.235.240:42740] [client 162.0.235.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.235.240, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdanIqL4zye-zKr6st_xgAAAMA"], referer: http://paramountestate.com
[Thu Nov 27 04:13:49.005240 2025] [:error] [pid 6202:tid 6251] [client 208.109.34.209:42448] [client 208.109.34.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.209, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSdffdJa7NTP0XPyZ6ld_AAAAFI"]
[Thu Nov 27 04:13:53.597302 2025] [:error] [pid 6203:tid 6268] [client 208.109.34.209:42040] [client 208.109.34.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.209, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSdfgcbdRL7aKyrgqyy7cgAAAIg"]
[Thu Nov 27 04:13:56.384636 2025] [:error] [pid 21017:tid 21063] [client 208.109.34.209:42056] [client 208.109.34.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.209, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aSdfhKZA663ub03MMQt1FAAAAQQ"]
[Thu Nov 27 04:21:23.512090 2025] [:error] [pid 6201:tid 6210] [client 103.92.85.202:59732] [client 103.92.85.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.92.85.202, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdhQzkSJeRkIQGTjzwa5QAAAAU"], referer: http://paramountestate.com
[Thu Nov 27 04:32:20.579047 2025] [:error] [pid 6203:tid 6260] [client 116.203.123.90:50330] [client 116.203.123.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.203.123.90, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdj1MbdRL7aKyrgqyzA3AAAAIA"], referer: http://paramountestate.com
[Thu Nov 27 05:01:41.870315 2025] [:error] [pid 21017:tid 21061] [client 51.255.69.200:53208] [client 51.255.69.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.255.69.200, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdqtaZA663ub03MMQuHiAAAAQI"], referer: http://paramountestate.com
[Thu Nov 27 05:12:37.941941 2025] [:error] [pid 21017:tid 21083] [client 212.18.224.162:57018] [client 212.18.224.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.18.224.162, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdtRaZA663ub03MMQuMxwAAARg"], referer: http://paramountestate.com
[Thu Nov 27 05:30:51.176365 2025] [:error] [pid 6201:tid 6224] [client 186.250.243.195:59186] [client 186.250.243.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.250.243.195, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSdxizkSJeRkIQGTjzwrKgAAABM"], referer: http://paramountestate.com
[Thu Nov 27 06:46:06.194669 2025] [:error] [pid 25779:tid 25791] [client 213.142.131.109:50430] [client 213.142.131.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.142.131.109, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSeDLg46CBd-XtAmfkNcRQAAAIg"], referer: http://paramountestate.com
[Thu Nov 27 07:11:50.750485 2025] [:error] [pid 48929:tid 48971] [client 82.221.129.40:42378] [client 82.221.129.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.221.129.40, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSeJNhsXTHq9V_4xD5TkOwAAAIQ"], referer: http://paramountestate.com
[Thu Nov 27 09:15:52.792818 2025] [:error] [pid 19014:tid 19051] [client 185.128.137.211:34946] [client 185.128.137.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.128.137.211, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aSemSI2utvwZ4eADRmoDigAAAEc"], referer: http://paramountestate.com
[Tue Mar 10 15:58:07.179783 2026] [:error] [pid 21400:tid 21404] [client 43.130.60.195:37272] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aa_PDzCFYMzi4orNuEHBlQAAAMI"]
[Tue Mar 10 16:41:35.272003 2026] [:error] [pid 21400:tid 21416] [client 14.215.163.132:49273] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aa_ZPzCFYMzi4orNuEHXYQAAAM4"]
2026/03/10 22:45:46 [error] 3843#3843: *209689 access forbidden by rule, client: 62.164.177.15, server: paramountestate.com, request: "GET /.svn/wc.db HTTP/1.1", host: "paramountestate.com"
[Wed Mar 11 07:48:36.204966 2026] [:error] [pid 11796:tid 11810] [client 209.87.169.97:40382] [client 209.87.169.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abCt1AEDXoQrlStpO9AhWAAAAYw"]
[Wed Mar 11 12:25:46.906560 2026] [:error] [pid 54045:tid 54067] [client 37.251.16.163:39288] [client 37.251.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abDuyiRcKzQ1f-N8TgQ0rAAAANQ"]
[Wed Mar 11 13:09:26.187292 2026] [:error] [pid 23512:tid 23523] [client 62.36.115.224:48712] [client 62.36.115.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abD5BqeuPtNfm7KRzWXBaAAAAUg"]
2026/03/11 17:36:56 [error] 53937#53937: *946413 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "paramountestate.com"
[Wed Mar 11 17:36:56.411097 2026] [:error] [pid 53954:tid 53985] [client 209.38.31.95:40536] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abE3uLbD1J_Nhe6jce2OJgAAAEE"]
[Wed Mar 11 17:36:56.426069 2026] [:error] [pid 54045:tid 54056] [client 209.38.31.95:40538] [client 209.38.31.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "abE3uCRcKzQ1f-N8TgR6MAAAAMk"]
2026/03/11 17:36:56 [error] 53937#53937: *946413 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /wp HTTP/1.1", upstream: "http://103.4.122.14:8181/wp", host: "paramountestate.com"
[Wed Mar 11 17:36:56.444097 2026] [:error] [pid 45143:tid 45151] [client 209.38.31.95:40542] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp"] [unique_id "abE3uCEXSpYdWImkpzbLtQAAAYY"]
[Wed Mar 11 17:36:56.453846 2026] [:error] [pid 54045:tid 54063] [client 209.38.31.95:40544] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/new"] [unique_id "abE3uCRcKzQ1f-N8TgR6MQAAANA"]
2026/03/11 17:36:56 [error] 53941#53941: *946418 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /new HTTP/1.1", upstream: "http://103.4.122.14:8181/new", host: "paramountestate.com"
2026/03/11 17:36:56 [error] 53945#53945: *946419 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "paramountestate.com"
[Wed Mar 11 17:36:56.455318 2026] [:error] [pid 45143:tid 45157] [client 209.38.31.95:40546] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abE3uCEXSpYdWImkpzbLtgAAAYw"]
[Wed Mar 11 17:36:56.455487 2026] [:error] [pid 54045:tid 54070] [client 209.38.31.95:40548] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/debug/default/index"] [unique_id "abE3uCRcKzQ1f-N8TgR6MgAAANc"]
2026/03/11 17:36:56 [error] 53945#53945: *946421 access forbidden by rule, client: 209.38.31.95, server: paramountestate.com, request: "GET /.git/config HTTP/1.1", host: "paramountestate.com"
2026/03/11 17:36:56 [error] 53945#53945: *946420 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /debug/default/index HTTP/1.1", upstream: "http://103.4.122.14:8181/debug/default/index", host: "paramountestate.com"
2026/03/11 17:36:56 [error] 53941#53941: *946422 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /wordpress HTTP/1.1", upstream: "http://103.4.122.14:8181/wordpress", host: "paramountestate.com"
[Wed Mar 11 17:36:56.457873 2026] [:error] [pid 44995:tid 45014] [client 209.38.31.95:40550] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wordpress"] [unique_id "abE3uDoOSr9ks_axo6ORiAAAAlE"]
[Wed Mar 11 17:36:56.458611 2026] [:error] [pid 44995:tid 44997] [client 209.38.31.95:40552] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blog"] [unique_id "abE3uDoOSr9ks_axo6ORiQAAAkA"]
2026/03/11 17:36:56 [error] 53939#53939: *946424 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /blog HTTP/1.1", upstream: "http://103.4.122.14:8181/blog", host: "paramountestate.com"
2026/03/11 17:36:56 [error] 53941#53941: *946425 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /demo HTTP/1.1", upstream: "http://103.4.122.14:8181/demo", host: "paramountestate.com"
[Wed Mar 11 17:36:56.459497 2026] [:error] [pid 54045:tid 54061] [client 209.38.31.95:40554] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/demo"] [unique_id "abE3uCRcKzQ1f-N8TgR6MwAAAM4"]
2026/03/11 17:36:56 [error] 53941#53941: *946418 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /vendor/laravel-filemanager/js/script.js HTTP/1.1", upstream: "http://103.4.122.14:8181/vendor/laravel-filemanager/js/script.js", host: "paramountestate.com"
[Wed Mar 11 17:36:56.470323 2026] [:error] [pid 44995:tid 45019] [client 209.38.31.95:40556] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vendor/laravel-filemanager/js/script.js"] [unique_id "abE3uDoOSr9ks_axo6ORigAAAlY"]
2026/03/11 17:36:56 [error] 53945#53945: *946419 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1", upstream: "http://103.4.122.14:8181/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", host: "paramountestate.com"
[Wed Mar 11 17:36:56.470816 2026] [:error] [pid 44995:tid 45004] [client 209.38.31.95:40558] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "abE3uDoOSr9ks_axo6ORiwAAAkc"]
[Wed Mar 11 17:36:56.471147 2026] [:error] [pid 44995:tid 45021] [client 209.38.31.95:40560] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abE3uDoOSr9ks_axo6ORjAAAAlg"]
2026/03/11 17:36:56 [error] 53941#53941: *946426 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "POST / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "paramountestate.com"
2026/03/11 17:36:56 [error] 53941#53941: *946426 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /_ignition/execute-solution HTTP/1.1", upstream: "http://103.4.122.14:8181/_ignition/execute-solution", host: "paramountestate.com"
[Wed Mar 11 17:36:56.487021 2026] [:error] [pid 44800:tid 44804] [client 209.38.31.95:40566] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/_ignition/execute-solution"] [unique_id "abE3uDN8ZerbIEHTO2qUCQAAAcI"]
2026/03/11 17:36:56 [error] 53939#53939: *946424 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com, request: "GET /public/vendor/laravel-filemanager/js/script.js HTTP/1.1", upstream: "http://103.4.122.14:8181/public/vendor/laravel-filemanager/js/script.js", host: "paramountestate.com"
[Wed Mar 11 17:36:56.487021 2026] [:error] [pid 44995:tid 45007] [client 209.38.31.95:40564] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/public/vendor/laravel-filemanager/js/script.js"] [unique_id "abE3uDoOSr9ks_axo6ORjQAAAko"]
[Wed Mar 11 22:31:29.606401 2026] [:error] [pid 54045:tid 54071] [client 47.230.10.49:53952] [client 47.230.10.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abF8wSRcKzQ1f-N8TgT81QAAANg"]
[Thu Mar 12 07:11:50.696449 2026] [:error] [pid 51540:tid 51547] [client 20.220.148.157:25489] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/brand.php"] [unique_id "abH2tmOFFjotMIN2UD0ypAAAAMU"]
[Thu Mar 12 07:11:51.545384 2026] [:error] [pid 51455:tid 51477] [client 20.220.148.157:37918] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/brand.php"] [unique_id "abH2t5E0YyNxdg6PL_D1EQAAABE"]
[Thu Mar 12 07:11:52.269526 2026] [:error] [pid 51540:tid 51544] [client 20.220.148.157:25472] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/brand.php"] [unique_id "abH2uGOFFjotMIN2UD0ypQAAAMI"]
[Thu Mar 12 07:11:53.144353 2026] [:error] [pid 51455:tid 51478] [client 20.220.148.157:25858] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/brand.php"] [unique_id "abH2uZE0YyNxdg6PL_D1EwAAABI"]
[Thu Mar 12 07:11:53.750729 2026] [:error] [pid 51457:tid 51536] [client 20.220.148.157:44261] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "abH2uSjknw2FvT4H3DZrYAAAAJY"]
[Thu Mar 12 07:11:54.334706 2026] [:error] [pid 51455:tid 51483] [client 20.220.148.157:37195] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "abH2upE0YyNxdg6PL_D1FAAAABc"]
[Thu Mar 12 07:11:54.943753 2026] [:error] [pid 51457:tid 51523] [client 20.220.148.157:44552] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "abH2uijknw2FvT4H3DZrYwAAAIk"]
[Thu Mar 12 07:11:55.744652 2026] [:error] [pid 51540:tid 51546] [client 20.220.148.157:37920] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "abH2u2OFFjotMIN2UD0yrAAAAMQ"]
[Thu Mar 12 07:11:56.623900 2026] [:error] [pid 51540:tid 51548] [client 20.220.148.157:44181] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abH2vGOFFjotMIN2UD0yrgAAAMY"]
[Thu Mar 12 07:11:57.084144 2026] [:error] [pid 51457:tid 51522] [client 20.220.148.157:44169] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abH2vSjknw2FvT4H3DZrawAAAIg"]
[Thu Mar 12 07:11:57.858931 2026] [:error] [pid 51540:tid 51553] [client 20.220.148.157:25510] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abH2vWOFFjotMIN2UD0yrwAAAMs"]
[Thu Mar 12 07:11:58.713549 2026] [:error] [pid 51456:tid 51500] [client 20.220.148.157:44276] [client 20.220.148.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abH2vhXu8LzVixNGr0smuwAAAE0"]
[Thu Mar 12 07:34:29.995163 2026] [:error] [pid 51540:tid 51566] [client 43.138.68.113:45908] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abH8BWOFFjotMIN2UD0_GQAAANg"]
[Thu Mar 12 11:12:37.942121 2026] [:error] [pid 51455:tid 51482] [client 49.51.195.195:40322] [client 49.51.195.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abIvJZE0YyNxdg6PL_BLNwAAABY"]
[Thu Mar 12 11:58:13.909397 2026] [:error] [pid 22063:tid 22080] [client 130.12.182.150:46078] [client 130.12.182.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "abI51a0RUhS-MJyHWLSdbwAAAg8"]
[Thu Mar 12 11:58:14.811471 2026] [:error] [pid 51540:tid 51563] [client 130.12.182.150:49994] [client 130.12.182.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "abI51mOFFjotMIN2UD2J2AAAANU"]
[Thu Mar 12 13:43:03.431372 2026] [:error] [pid 51455:tid 51480] [client 94.247.172.129:20682] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abJSZ5E0YyNxdg6PL_C-EAAAABQ"]
[Thu Mar 12 14:03:59.481030 2026] [:error] [pid 51456:tid 51511] [client 101.33.66.34:47142] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abJXTxXu8LzVixNGr0tMMgAAAFg"]
[Thu Mar 12 14:04:13.408414 2026] [:error] [pid 8249:tid 8270] [client 101.42.46.71:58728] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abJXXSK5dL3-8Jdf0M1-pAAAARM"]
[Thu Mar 12 16:41:06.040181 2026] [:error] [pid 8249:tid 8267] [client 93.183.176.129:57309] [client 93.183.176.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.183.176.129, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abJ8IiK5dL3-8Jdf0M3a5wAAARA"]
[Thu Mar 12 18:25:20.995512 2026] [:error] [pid 51455:tid 51482] [client 103.65.236.149:52797] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "abKUkJE0YyNxdg6PL_AvKwAAABY"]
[Thu Mar 12 18:25:21.223248 2026] [:error] [pid 51455:tid 51464] [client 103.65.236.149:52817] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.vscode/sftp.json"] [unique_id "abKUkZE0YyNxdg6PL_AvLAAAAAQ"]
[Thu Mar 12 20:18:49.517768 2026] [:error] [pid 51457:tid 51534] [client 194.180.48.253:60748] [client 194.180.48.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "abKvKSjknw2FvT4H3Da-DAAAAJQ"]
[Thu Mar 12 20:37:17.210315 2026] [:error] [pid 11986:tid 12039] [client 106.119.167.146:47562] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abKzfTKqY2w-DVCrxTATvAAAAdU"]
[Fri Mar 13 00:17:21.494151 2026] [:error] [pid 11953:tid 11968] [client 20.151.108.217:62893] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "abLnEZudzqsnq3bvtDaZNAAAAU0"]
[Fri Mar 13 00:17:22.326988 2026] [:error] [pid 20467:tid 20483] [client 20.151.108.217:39375] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/2024/"] [unique_id "abLnEnJ3UvosyIqy8ay_mAAAAo0"]
[Fri Mar 13 00:17:23.173079 2026] [:error] [pid 11986:tid 12020] [client 20.151.108.217:39388] [client 20.151.108.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.108.217, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abLnEzKqY2w-DVCrxTBP2wAAAcI"]
[Fri Mar 13 00:17:23.173140 2026] [:error] [pid 11986:tid 12020] [client 20.151.108.217:39388] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abLnEzKqY2w-DVCrxTBP2wAAAcI"]
[Fri Mar 13 00:17:24.000352 2026] [:error] [pid 51457:tid 51515] [client 20.151.108.217:39416] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-corn-sample.php"] [unique_id "abLnEyjknw2FvT4H3DbkkwAAAIE"]
[Fri Mar 13 00:17:24.833501 2026] [:error] [pid 51457:tid 51529] [client 20.151.108.217:39409] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/"] [unique_id "abLnFCjknw2FvT4H3DbklAAAAI8"]
[Fri Mar 13 00:17:25.679519 2026] [:error] [pid 11953:tid 11958] [client 20.151.108.217:62854] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "abLnFZudzqsnq3bvtDaZVgAAAUM"]
[Fri Mar 13 00:17:26.550425 2026] [:error] [pid 51457:tid 51522] [client 20.151.108.217:39397] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin/css/index.php"] [unique_id "abLnFijknw2FvT4H3DbklQAAAIg"]
[Fri Mar 13 00:17:27.380485 2026] [:error] [pid 8249:tid 8270] [client 20.151.108.217:62880] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/server.php"] [unique_id "abLnFyK5dL3-8Jdf0M2tkAAAARM"]
[Fri Mar 13 00:17:28.207536 2026] [:error] [pid 11986:tid 12019] [client 20.151.108.217:39417] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/"] [unique_id "abLnGDKqY2w-DVCrxTBP5AAAAcE"]
[Fri Mar 13 00:17:29.036344 2026] [:error] [pid 11986:tid 12025] [client 20.151.108.217:39389] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin/js/"] [unique_id "abLnGTKqY2w-DVCrxTBP6AAAAcc"]
[Fri Mar 13 00:17:29.865785 2026] [:error] [pid 20530:tid 20608] [client 20.151.108.217:39387] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wso.php"] [unique_id "abLnGQkNGxMzPO-s9qcexgAAA5M"]
[Fri Mar 13 00:17:30.691468 2026] [:error] [pid 51456:tid 51511] [client 20.151.108.217:39391] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/"] [unique_id "abLnGhXu8LzVixNGr0uY1AAAAFg"]
[Fri Mar 13 00:17:31.516830 2026] [:error] [pid 11953:tid 11968] [client 20.151.108.217:62468] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-file.php"] [unique_id "abLnG5udzqsnq3bvtDaZXwAAAU0"]
[Fri Mar 13 00:17:32.355108 2026] [:error] [pid 8249:tid 8275] [client 20.151.108.217:39386] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "abLnHCK5dL3-8Jdf0M2tkgAAARg"]
[Fri Mar 13 00:17:33.179824 2026] [:error] [pid 11953:tid 11961] [client 20.151.108.217:39361] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wk/index.php"] [unique_id "abLnHZudzqsnq3bvtDaZYgAAAUY"]
[Fri Mar 13 00:17:34.011308 2026] [:error] [pid 8249:tid 8263] [client 20.151.108.217:39364] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin.php"] [unique_id "abLnHiK5dL3-8Jdf0M2tlAAAAQw"]
[Fri Mar 13 00:17:34.836845 2026] [:error] [pid 8249:tid 8257] [client 20.151.108.217:62877] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/themes/admin.php"] [unique_id "abLnHiK5dL3-8Jdf0M2tlwAAAQY"]
[Fri Mar 13 00:17:35.663675 2026] [:error] [pid 11953:tid 11967] [client 20.151.108.217:39362] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/"] [unique_id "abLnH5udzqsnq3bvtDaZZAAAAUw"]
[Fri Mar 13 00:17:36.494783 2026] [:error] [pid 51457:tid 51514] [client 20.151.108.217:62479] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/xmrlpc.php"] [unique_id "abLnICjknw2FvT4H3DbkmgAAAIA"]
[Fri Mar 13 00:17:37.324564 2026] [:error] [pid 8249:tid 8265] [client 20.151.108.217:39405] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abLnISK5dL3-8Jdf0M2tmwAAAQ4"]
[Fri Mar 13 00:17:38.148336 2026] [:error] [pid 8249:tid 8261] [client 20.151.108.217:62892] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin/file.php"] [unique_id "abLnIiK5dL3-8Jdf0M2tngAAAQo"]
[Fri Mar 13 00:17:38.979463 2026] [:error] [pid 11953:tid 11971] [client 20.151.108.217:62465] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abLnIpudzqsnq3bvtDaZZwAAAVA"]
[Fri Mar 13 00:17:39.810315 2026] [:error] [pid 20467:tid 20479] [client 20.151.108.217:62906] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "abLnI3J3UvosyIqy8ay_owAAAok"]
[Fri Mar 13 00:17:40.644049 2026] [:error] [pid 11953:tid 11966] [client 20.151.108.217:39404] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/css/index.php"] [unique_id "abLnJJudzqsnq3bvtDaZagAAAUs"]
[Fri Mar 13 00:17:41.468384 2026] [:error] [pid 8249:tid 8253] [client 20.151.108.217:39371] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/et-cache/"] [unique_id "abLnJSK5dL3-8Jdf0M2tnwAAAQI"]
[Fri Mar 13 00:17:42.297726 2026] [:error] [pid 8249:tid 8254] [client 20.151.108.217:39403] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "abLnJiK5dL3-8Jdf0M2tpgAAAQM"]
[Fri Mar 13 00:17:43.130023 2026] [:error] [pid 11953:tid 11955] [client 20.151.108.217:62873] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "abLnJ5udzqsnq3bvtDaZawAAAUA"]
[Fri Mar 13 00:17:43.954078 2026] [:error] [pid 8249:tid 8252] [client 20.151.108.217:62861] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/index.php"] [unique_id "abLnJyK5dL3-8Jdf0M2tpwAAAQE"]
[Fri Mar 13 00:17:44.778104 2026] [:error] [pid 8249:tid 8267] [client 20.151.108.217:62889] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "abLnKCK5dL3-8Jdf0M2tqAAAARA"]
[Fri Mar 13 00:17:45.627879 2026] [:error] [pid 11953:tid 11956] [client 20.151.108.217:62887] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/"] [unique_id "abLnKZudzqsnq3bvtDaZbwAAAUE"]
[Fri Mar 13 00:17:46.468305 2026] [:error] [pid 11953:tid 11957] [client 20.151.108.217:39382] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "abLnKpudzqsnq3bvtDaZcQAAAUI"]
[Fri Mar 13 00:17:47.310867 2026] [:error] [pid 20528:tid 20557] [client 20.151.108.217:39423] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/block/"] [unique_id "abLnK6nDNsf46-tKxqki9wAAAxc"]
[Fri Mar 13 00:17:48.167177 2026] [:error] [pid 11953:tid 11973] [client 20.151.108.217:39420] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/as.php"] [unique_id "abLnLJudzqsnq3bvtDaZdQAAAVI"]
[Fri Mar 13 00:17:49.001724 2026] [:error] [pid 8249:tid 8251] [client 20.151.108.217:62851] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abLnLSK5dL3-8Jdf0M2tqwAAAQA"]
[Fri Mar 13 00:17:49.830837 2026] [:error] [pid 51456:tid 51492] [client 20.151.108.217:62863] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/buy.php"] [unique_id "abLnLRXu8LzVixNGr0uY3AAAAEU"]
[Fri Mar 13 00:17:50.671399 2026] [:error] [pid 11986:tid 12035] [client 20.151.108.217:62908] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp.php"] [unique_id "abLnLjKqY2w-DVCrxTBP7QAAAdE"]
[Fri Mar 13 00:17:51.499221 2026] [:error] [pid 11953:tid 11960] [client 20.151.108.217:64786] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin/images/index.php"] [unique_id "abLnL5udzqsnq3bvtDaZfAAAAUU"]
[Fri Mar 13 00:17:52.348603 2026] [:error] [pid 51456:tid 51505] [client 20.151.108.217:64799] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/about.PHP"] [unique_id "abLnMBXu8LzVixNGr0uY3wAAAFI"]
[Fri Mar 13 00:17:53.195906 2026] [:error] [pid 20530:tid 20576] [client 20.151.108.217:39412] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "abLnMQkNGxMzPO-s9qceygAAA4I"]
[Fri Mar 13 00:17:54.023989 2026] [:error] [pid 11953:tid 11965] [client 20.151.108.217:39373] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/index.php"] [unique_id "abLnMpudzqsnq3bvtDaZgAAAAUo"]
[Fri Mar 13 00:17:54.849602 2026] [:error] [pid 20529:tid 20601] [client 20.151.108.217:62860] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/edit.php"] [unique_id "abLnMm4BhuYHZriajQ-NlgAAA1g"]
[Fri Mar 13 00:17:55.682324 2026] [:error] [pid 20531:tid 20625] [client 20.151.108.217:62878] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/sf.php"] [unique_id "abLnM_vw-RvNQd9b3a-9cAAAA8k"]
[Fri Mar 13 00:17:56.505174 2026] [:error] [pid 11953:tid 11962] [client 20.151.108.217:64826] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "abLnNJudzqsnq3bvtDaZhQAAAUc"]
[Fri Mar 13 00:17:57.333253 2026] [:error] [pid 11953:tid 11958] [client 20.151.108.217:39297] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/file.php"] [unique_id "abLnNZudzqsnq3bvtDaZjQAAAUM"]
[Fri Mar 13 00:17:58.172013 2026] [:error] [pid 11953:tid 11966] [client 20.151.108.217:64829] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "abLnNpudzqsnq3bvtDaZjwAAAUs"]
[Fri Mar 13 00:17:59.015536 2026] [:error] [pid 20528:tid 20545] [client 20.151.108.217:64787] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/cgi-bin/"] [unique_id "abLnN6nDNsf46-tKxqki-QAAAws"]
[Fri Mar 13 00:17:59.858414 2026] [:error] [pid 51456:tid 51499] [client 20.151.108.217:39413] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "abLnNxXu8LzVixNGr0uY4AAAAEw"]
[Fri Mar 13 00:18:00.685321 2026] [:error] [pid 20530:tid 20609] [client 20.151.108.217:64791] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-cron.php"] [unique_id "abLnOAkNGxMzPO-s9qceywAAA5Q"]
[Fri Mar 13 00:18:01.517492 2026] [:error] [pid 20531:tid 20633] [client 20.151.108.217:64801] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/"] [unique_id "abLnOfvw-RvNQd9b3a-9dAAAA9E"]
[Fri Mar 13 00:18:04.072867 2026] [:error] [pid 20529:tid 20597] [client 20.151.108.217:39410] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "abLnPG4BhuYHZriajQ-NlwAAA1Y"]
[Fri Mar 13 00:18:04.899185 2026] [:error] [pid 11986:tid 12033] [client 20.151.108.217:62872] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/wp-content/1.php"] [unique_id "abLnPDKqY2w-DVCrxTBP8AAAAc8"]
[Fri Mar 13 00:18:05.724764 2026] [:error] [pid 8249:tid 8262] [client 20.151.108.217:64769] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 14"] [hostname "paramountestate.com"] [uri "/images/index.php"] [unique_id "abLnPSK5dL3-8Jdf0M2ttwAAAQs"]
[Fri Mar 13 03:57:42.329928 2026] [:error] [pid 61928:tid 61994] [client 43.153.123.4:38780] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abMatgod66AHekJJZioGPAAAAFE"]
[Fri Mar 13 07:05:42.340139 2026] [:error] [pid 44755:tid 44781] [client 152.59.145.163:59479] [client 152.59.145.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.145.163, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abNGxvONf1H0XrBFE4OOnQAAARg"]
[Fri Mar 13 09:11:31.520923 2026] [:error] [pid 55077:tid 55083] [client 175.6.217.4:38111] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abNkQ99Ul5ym4M-PlQJAYgAAAUQ"]
[Fri Mar 13 09:50:27.740183 2026] [:error] [pid 55077:tid 55095] [client 209.87.169.141:39191] [client 209.87.169.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.141, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abNtY99Ul5ym4M-PlQJV6QAAAVA"]
[Fri Mar 13 18:30:13.691587 2026] [:error] [pid 55077:tid 55100] [client 39.63.86.37:62425] [client 39.63.86.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.63.86.37, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abPnNd9Ul5ym4M-PlQLRxwAAAVU"]
[Fri Mar 13 18:31:13.249409 2026] [:error] [pid 9309:tid 9340] [client 106.51.105.77:54291] [client 106.51.105.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.105.77, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abPncao1KEMMghNWAN8ihgAAAhE"]
[Fri Mar 13 18:31:44.603200 2026] [:error] [pid 62036:tid 62061] [client 129.222.109.187:59266] [client 129.222.109.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.109.187, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abPnkLce6g9kILuh_R50mAAAANI"]
[Fri Mar 13 18:32:15.544063 2026] [:error] [pid 61927:tid 61955] [client 197.234.118.22:64581] [client 197.234.118.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.234.118.22, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abPnr7LkK584eBa2J7X_SAAAAAk"]
[Fri Mar 13 18:35:14.246445 2026] [:error] [pid 9309:tid 9337] [client 170.106.165.186:36622] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abPoYqo1KEMMghNWAN8j3gAAAg4"]
[Fri Mar 13 20:39:03.203140 2026] [:error] [pid 61927:tid 61951] [client 181.124.145.167:42539] [client 181.124.145.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.124.145.167, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abQFZ7LkK584eBa2J7UFCAAAAAU"]
[Fri Mar 13 20:46:35.535770 2026] [:error] [pid 61929:tid 62016] [client 59.91.133.150:54433] [client 59.91.133.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.91.133.150, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abQHKzGGsow2jgUjLtyy6gAAAIw"]
[Fri Mar 13 21:11:53.959174 2026] [:error] [pid 9111:tid 9150] [client 43.153.27.244:43610] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abQNGU-M156SLpD2BrtXVwAAAZg"]
[Fri Mar 13 21:45:42.925587 2026] [:error] [pid 60496:tid 60505] [client 4.204.197.4:64471] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abQVBgb67oGiJ3jaL8z_hgAAA0E"]
[Fri Mar 13 21:45:43.341898 2026] [:error] [pid 61928:tid 61983] [client 4.204.197.4:65128] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abQVBwod66AHekJJZiqojwAAAEY"]
[Fri Mar 13 21:45:43.760190 2026] [:error] [pid 60398:tid 60418] [client 4.204.197.4:65091] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abQVB0CJdGSTt6QlH2BOdwAAAo8"]
[Fri Mar 13 21:45:44.174910 2026] [:error] [pid 9309:tid 9345] [client 4.204.197.4:65079] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abQVCKo1KEMMghNWAN9QQwAAAhY"]
[Fri Mar 13 21:52:04.336923 2026] [:error] [pid 60398:tid 60411] [client 51.89.43.80:49893] [client 51.89.43.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "abQWhECJdGSTt6QlH2BPEAAAAog"]
[Sat Mar 14 04:17:55.765675 2026] [:error] [pid 3913:tid 3971] [client 20.63.80.127:11469] [client 20.63.80.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.80.127, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abRw8x9qvQd4GQHUp6_uGgAAAE4"]
[Sat Mar 14 04:17:59.662518 2026] [:error] [pid 3913:tid 3964] [client 20.63.80.127:11469] [client 20.63.80.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abRw9x9qvQd4GQHUp6_uLQAAAEc"]
[Sat Mar 14 04:18:02.937517 2026] [:error] [pid 35801:tid 35825] [client 20.63.80.127:12249] [client 20.63.80.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "abRw-m8tVFelXGsqbU-IKAAAARU"]
[Sat Mar 14 04:18:07.202303 2026] [:error] [pid 35801:tid 35805] [client 20.63.80.127:11465] [client 20.63.80.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abRw_28tVFelXGsqbU-INwAAAQE"]
[Sat Mar 14 04:18:12.476244 2026] [:error] [pid 3914:tid 3994] [client 20.63.80.127:12266] [client 20.63.80.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "abRxBPH_HeUqa_sn9-D1VQAAAIo"]
[Sat Mar 14 05:00:17.601458 2026] [:error] [pid 3914:tid 3996] [client 185.137.164.18:27025] [client 185.137.164.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/HEAD"] [unique_id "abR64fH_HeUqa_sn9-ABkAAAAIw"]
[Sat Mar 14 05:03:07.393826 2026] [:error] [pid 3914:tid 4004] [client 43.154.127.188:33378] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abR7i_H_HeUqa_sn9-ACTwAAAJQ"]
[Sat Mar 14 10:54:18.943410 2026] [:error] [pid 54134:tid 54210] [client 197.45.253.22:60451] [client 197.45.253.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.45.253.22, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abTN2saBYw3j-g43wMEptQAAA9M"]
[Sat Mar 14 11:30:18.994093 2026] [:error] [pid 13262:tid 13297] [client 86.124.127.128:62289] [client 86.124.127.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.124.127.128, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abTWSjAdvM7ft5BXQ2dxzQAAAYQ"]
[Sat Mar 14 11:46:27.693806 2026] [:error] [pid 13360:tid 13374] [client 180.110.203.108:41341] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abTaE_oSWtMry3M5X6vYbAAAAoo"]
[Sat Mar 14 19:44:01.723872 2026] [:error] [pid 13151:tid 13174] [client 119.28.177.175:51548] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abVKAdbXrXQxFzrsw41aTQAAAJU"]
[Sat Mar 14 22:08:18.820617 2026] [:error] [pid 30154:tid 30169] [client 162.62.213.187:36066] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abVr0l6OP9woRgp3v0GaNQAAAMk"]
[Sun Mar 15 00:48:02.103034 2026] [:error] [pid 20020:tid 20034] [client 49.51.47.100:50528] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abWRQkPjaRwagw2fU7j5ywAAAEw"]
[Sun Mar 15 08:27:35.221404 2026] [:error] [pid 38540:tid 38604] [client 43.153.122.30:39600] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abX8918bnHsJ1dE90bIFZAAAAFI"]
[Sun Mar 15 11:17:57.635312 2026] [:error] [pid 50986:tid 51011] [client 109.71.177.133:54236] [client 109.71.177.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.71.177.133, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abYk5SknK4c779bcQqEgEgAAAVY"]
[Sun Mar 15 14:28:01.603850 2026] [:error] [pid 38540:tid 38597] [client 117.62.235.53:60534] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abZRcV8bnHsJ1dE90bJSzQAAAEs"]
[Sun Mar 15 17:33:00.653286 2026] [:error] [pid 38541:tid 38628] [client 162.62.213.165:53530] [client 162.62.213.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abZ8zHuOpex8jIO0jt6FqgAAAI8"]
[Sun Mar 15 19:01:42.378486 2026] [:error] [pid 45974:tid 45990] [client 91.73.97.31:36905] [client 91.73.97.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.73.97.31, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abaRlhWn4R6u72Segei_7gAAAg4"]
[Sun Mar 15 20:07:01.874716 2026] [:error] [pid 50986:tid 51006] [client 43.153.10.83:49022] [client 43.153.10.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abag5SknK4c779bcQqHSxwAAAVE"]
[Sun Mar 15 21:30:09.321343 2026] [:error] [pid 38536:tid 38557] [client 125.75.66.97:48878] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aba0YfpTEqkVJ0rBEWsRRQAAAAQ"]
[Sun Mar 15 22:33:52.853481 2026] [:error] [pid 38645:tid 38669] [client 49.51.36.179:55700] [client 49.51.36.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abbDUBFPHtsDUuVrWDbobgAAANY"]
[Mon Mar 16 01:05:43.273815 2026] [:error] [pid 60694:tid 60827] [client 43.153.119.119:44638] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abbm52EURh3k32p5sFJ7gwAAAJU"]
[Mon Mar 16 04:01:23.628547 2026] [:error] [pid 62529:tid 62554] [client 43.130.60.195:51670] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abcQEz84-luOVYZKK0M03QAAANE"]
[Mon Mar 16 07:02:28.597418 2026] [:error] [pid 62427:tid 62448] [client 203.188.168.30:25041] [client 203.188.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.30, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abc6hMUPP8fzo6XzJCUiTQAAAAc"]
[Mon Mar 16 08:24:41.783038 2026] [:error] [pid 62428:tid 62480] [client 103.65.237.124:59186] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "abdNyarHSRXFZx1-aIHwCgAAAEs"]
[Mon Mar 16 09:22:04.935447 2026] [:error] [pid 1411:tid 1430] [client 165.22.188.120:51288] [client 165.22.188.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/favicon.ico"] [unique_id "abdbPNrCV4sh-le3M-2_pAAAAVA"]
[Mon Mar 16 09:22:05.349671 2026] [:error] [pid 12822:tid 12845] [client 165.22.188.120:51296] [client 165.22.188.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "abdbPYG9Ft4WPo7r7sRzbQAAAco"]
[Mon Mar 16 09:22:05.717210 2026] [:error] [pid 62529:tid 62560] [client 165.22.188.120:47656] [client 165.22.188.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/favicon.ico"] [unique_id "abdbPT84-luOVYZKK0O18gAAANc"]
[Mon Mar 16 09:22:06.551516 2026] [:error] [pid 1411:tid 1420] [client 165.22.188.120:47682] [client 165.22.188.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "abdbPtrCV4sh-le3M-2_rQAAAUc"]
[Mon Mar 16 10:24:48.133642 2026] [:error] [pid 62025:tid 62073] [client 182.40.104.255:44334] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abdp8OimBfLmKh7zLXP41gAAAE4"]
[Mon Mar 16 10:26:24.782855 2026] [:error] [pid 62119:tid 62146] [client 45.132.225.87:44445] [client 45.132.225.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.132.225.87, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abdqUD-Co-Fir-PyAwe_rwAAANg"]
[Mon Mar 16 12:54:33.561420 2026] [:error] [pid 9354:tid 9379] [client 43.135.138.128:54002] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abeNCXBF0M4d8CifbJ5FKgAAAdA"]
[Mon Mar 16 14:06:07.350361 2026] [:error] [pid 62025:tid 62065] [client 103.105.172.10:9487] [client 103.105.172.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.105.172.10, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abedz-imBfLmKh7zLXNeBQAAAEY"]
[Mon Mar 16 15:36:53.894068 2026] [:error] [pid 62119:tid 62130] [client 43.130.116.87:42194] [client 43.130.116.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abezFT-Co-Fir-PyAwfldQAAAMg"]
[Mon Mar 16 17:01:02.844861 2026] [:error] [pid 35840:tid 35901] [client 110.166.71.39:50764] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abfGzkJFzfEsmtPx-M3lZwAAAIQ"]
[Mon Mar 16 19:54:33.212832 2026] [:error] [pid 35838:tid 35849] [client 64.89.163.113:64236] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abfveRroTe-x3JLtmo6WAAAAAAc"]
[Mon Mar 16 19:54:33.731304 2026] [:error] [pid 35838:tid 35848] [client 64.89.163.113:49303] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abfveRroTe-x3JLtmo6WEwAAAAY"]
[Mon Mar 16 19:54:34.268055 2026] [:error] [pid 35929:tid 35932] [client 64.89.163.113:64267] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abfvetW47dGpmA63hwSKwAAAAME"]
[Mon Mar 16 19:54:34.774482 2026] [:error] [pid 1871:tid 1881] [client 64.89.163.113:63974] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abfvejinTnZ8uiUPekE6mAAAAYg"]
[Mon Mar 16 19:54:35.370916 2026] [:error] [pid 35840:tid 35913] [client 64.89.163.113:64756] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abfve0JFzfEsmtPx-M0IpQAAAJA"]
[Mon Mar 16 21:42:23.180456 2026] [:error] [pid 1871:tid 1887] [client 173.239.224.117:62051] [client 173.239.224.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.117, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abgIvzinTnZ8uiUPekFmagAAAY4"]
[Mon Mar 16 21:42:25.930406 2026] [:error] [pid 1871:tid 1890] [client 173.239.224.106:56415] [client 173.239.224.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.106, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abgIwTinTnZ8uiUPekFmfQAAAZE"]
[Mon Mar 16 22:57:29.853786 2026] [:error] [pid 1871:tid 1880] [client 2.222.248.223:51687] [client 2.222.248.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.222.248.223, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abgaWTinTnZ8uiUPekGQLgAAAYc"]
[Mon Mar 16 23:19:21.718212 2026] [:error] [pid 35838:tid 35849] [client 43.133.139.6:54318] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abgfeRroTe-x3JLtmo7loAAAAAc"]
[Tue Mar 17 05:00:07.184639 2026] [:error] [pid 45916:tid 45970] [client 43.153.135.208:49994] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abhvV7iS53PnClk_C9DieAAAAEg"]
[Tue Mar 17 06:14:23.449814 2026] [:error] [pid 22541:tid 22569] [client 106.119.167.146:34764] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abiAv6S6JNY1-CTsTA_whQAAARc"]
[Tue Mar 17 07:44:01.879034 2026] [:error] [pid 22541:tid 22555] [client 43.159.128.237:53734] [client 43.159.128.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abiVwaS6JNY1-CTsTA8W-gAAAQk"]
[Tue Mar 17 07:56:12.872671 2026] [:error] [pid 45917:tid 45999] [client 185.223.152.144:53179] [client 185.223.152.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.144, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abiYnBMMhmeqL5fT_hex9QAAAIo"]
[Tue Mar 17 10:44:09.671399 2026] [:error] [pid 22541:tid 22563] [client 43.157.168.43:40214] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abi_-aS6JNY1-CTsTA9gCQAAARE"]
[Tue Mar 17 12:47:16.373497 2026] [:error] [pid 45916:tid 45965] [client 36.41.75.167:42476] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abjc1LiS53PnClk_C9C_BgAAAEM"]
[Tue Mar 17 13:21:14.214447 2026] [:error] [pid 45916:tid 45970] [client 43.130.72.40:39416] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abjkyriS53PnClk_C9DVXQAAAEg"]
[Tue Mar 17 14:35:05.544109 2026] [:error] [pid 15011:tid 15070] [client 175.157.92.174:61823] [client 175.157.92.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.92.174, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abj2GcNtgHlAHiPlDyox0QAAAdU"]
[Tue Mar 17 16:00:10.051041 2026] [:error] [pid 14817:tid 14840] [client 43.166.239.145:36318] [client 43.166.239.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abkKCuBWVgTpR3dKOgYEbQAAAU4"]
[Tue Mar 17 19:04:43.921425 2026] [:error] [pid 14817:tid 14839] [client 143.105.209.22:3524] [client 143.105.209.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.209.22, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abk1S-BWVgTpR3dKOgYr7wAAAU0"]
[Tue Mar 17 19:34:39.660781 2026] [:error] [pid 45915:tid 45945] [client 121.229.185.160:36721] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abk8T5h7U84ydzcrcnd0bwAAABA"]
[Tue Mar 17 21:13:29.994272 2026] [:error] [pid 14817:tid 14840] [client 43.157.181.189:38978] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ablTeeBWVgTpR3dKOgZgrAAAAU4"]
[Tue Mar 17 23:48:07.934639 2026] [:error] [pid 15013:tid 15079] [client 43.133.139.6:57418] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abl3t1Zc-p7DonmJmm1lgwAAAgI"]
[Wed Mar 18 02:31:40.224828 2026] [:error] [pid 40715:tid 40957] [client 43.157.142.101:51364] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abmeDGcms0rUPgdkLiEP5QAAABM"]
[Wed Mar 18 03:13:46.224341 2026] [:error] [pid 40716:tid 41022] [client 20.39.61.185:59077] [client 20.39.61.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.39.61.185, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abmn6hR6i4ByUuhUBASgcgAAAEE"]
[Wed Mar 18 03:13:48.243493 2026] [:error] [pid 40716:tid 41027] [client 20.39.61.185:59077] [client 20.39.61.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.39.61.185, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abmn7BR6i4ByUuhUBASgfQAAAEY"]
[Wed Mar 18 03:13:51.998309 2026] [:error] [pid 40716:tid 41045] [client 20.39.61.185:59077] [client 20.39.61.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "abmn7xR6i4ByUuhUBASgjAAAAFg"]
[Wed Mar 18 04:12:49.992849 2026] [:error] [pid 44965:tid 45034] [client 45.131.194.16:56763] [client 45.131.194.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.194.16, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abm1waNZys-oG-hM22hm_AAAAFg"]
[Wed Mar 18 06:46:07.694298 2026] [:error] [pid 45069:tid 45078] [client 157.15.158.244:58202] [client 157.15.158.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.15.158.244, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abnZrzNzUMBULZVa94z3jgAAAMc"]
[Wed Mar 18 07:01:57.341089 2026] [:error] [pid 13716:tid 13733] [client 103.77.107.204:59160] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abndZWWKzQVHkZkUHaQggAAAAU8"]
[Wed Mar 18 07:01:57.609128 2026] [:error] [pid 13676:tid 13698] [client 103.77.107.204:59167] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/login"] [unique_id "abndZWxDEHR5lvAEVIj8LQAAARQ"]
[Wed Mar 18 07:02:00.351803 2026] [:error] [pid 13716:tid 13729] [client 103.77.107.204:59189] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin"] [unique_id "abndaGWKzQVHkZkUHaQgjgAAAUs"]
[Wed Mar 18 07:02:03.607905 2026] [:error] [pid 44965:tid 45024] [client 103.77.107.204:59207] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dashboard"] [unique_id "abnda6NZys-oG-hM22iLHQAAAE4"]
[Wed Mar 18 07:02:04.292805 2026] [:error] [pid 45069:tid 45092] [client 103.77.107.204:59278] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/register"] [unique_id "abndbDNzUMBULZVa94z98QAAANU"]
[Wed Mar 18 07:02:04.556479 2026] [:error] [pid 45069:tid 45090] [client 103.77.107.204:59287] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/home"] [unique_id "abndbDNzUMBULZVa94z99gAAANM"]
[Wed Mar 18 07:02:07.825804 2026] [:error] [pid 44965:tid 45029] [client 103.77.107.204:59295] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/profile"] [unique_id "abndb6NZys-oG-hM22iLIAAAAFM"]
[Wed Mar 18 07:02:09.806121 2026] [:error] [pid 44964:tid 44989] [client 103.77.107.204:59357] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/user"] [unique_id "abndccvMufm4ayzOOhBb8AAAAAs"]
[Wed Mar 18 07:02:10.058291 2026] [:error] [pid 13716:tid 13734] [client 103.77.107.204:59386] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/account"] [unique_id "abndcmWKzQVHkZkUHaQg1QAAAVA"]
[Wed Mar 18 07:02:12.182985 2026] [:error] [pid 13716:tid 13736] [client 103.77.107.204:59400] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/settings"] [unique_id "abnddGWKzQVHkZkUHaQg3QAAAVI"]
[Wed Mar 18 07:02:13.557625 2026] [:error] [pid 45069:tid 45072] [client 103.77.107.204:59449] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cms"] [unique_id "abnddTNzUMBULZVa94z-CgAAAME"]
[Wed Mar 18 07:02:14.199023 2026] [:error] [pid 13716:tid 13737] [client 103.77.107.204:59461] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin/login"] [unique_id "abnddmWKzQVHkZkUHaQg5gAAAVM"]
[Wed Mar 18 07:02:14.446859 2026] [:error] [pid 13676:tid 13691] [client 103.77.107.204:59466] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/administrator"] [unique_id "abnddmxDEHR5lvAEVIj8SAAAAQ0"]
[Wed Mar 18 07:02:18.080015 2026] [:error] [pid 13716:tid 13732] [client 103.77.107.204:59478] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/backend"] [unique_id "abndemWKzQVHkZkUHaQg-AAAAU4"]
[Wed Mar 18 08:13:18.637931 2026] [:error] [pid 13716:tid 13735] [client 20.2.90.103:39552] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "abnuHmWKzQVHkZkUHaRUBwAAAVE"]
[Wed Mar 18 08:20:47.101310 2026] [:error] [pid 44964:tid 44979] [client 43.130.228.73:36760] [client 43.130.228.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abnv38vMufm4ayzOOhBqOgAAAAE"]
[Wed Mar 18 14:10:56.400892 2026] [:error] [pid 42871:tid 42934] [client 102.91.93.104:43895] [client 102.91.93.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.93.104, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abpB8GPUS0lM1M9nUaK6tAAAAJQ"]
[Wed Mar 18 20:37:39.608407 2026] [:error] [pid 53755:tid 53761] [client 23.20.245.74:51001] [client 23.20.245.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.20.245.74, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abqck6qw5ZSRshmIhWk6dwAAAUQ"]
[Wed Mar 18 21:26:16.420905 2026] [:error] [pid 53755:tid 53777] [client 222.237.95.161:50438] [client 222.237.95.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.237.95.161, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abqn-Kqw5ZSRshmIhWlT8wAAAVQ"]
[Wed Mar 18 21:57:02.982201 2026] [:error] [pid 53755:tid 53759] [client 101.42.46.71:33280] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abqvLqqw5ZSRshmIhWlm_wAAAUI"]
[Wed Mar 18 22:15:17.937592 2026] [:error] [pid 43009:tid 43032] [client 49.51.183.220:55920] [client 49.51.183.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abqzdX8aUp4Sm6m3nmND2AAAARU"]
[Thu Mar 19 04:21:04.047497 2026] [:error] [pid 23988:tid 24006] [client 49.51.141.76:57044] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "absJMGnlkSPXj2matr3b6QAAAM8"]
[Thu Mar 19 04:52:20.134381 2026] [:error] [pid 23882:tid 23925] [client 106.220.183.198:5507] [client 106.220.183.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.220.183.198, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "absQhLWnClbtbN12M7_06AAAABc"]
[Thu Mar 19 06:31:04.423470 2026] [:error] [pid 3278:tid 3283] [client 31.171.130.14:55833] [client 31.171.130.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.14, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "absnqAC2T_lM6ZgvfcQ0pwAAAQI"]
[Thu Mar 19 07:43:57.695707 2026] [:error] [pid 3278:tid 3302] [client 91.99.186.86:59988] [client 91.99.186.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abs4vQC2T_lM6ZgvfcQ-OgAAARU"]
[Thu Mar 19 07:43:59.277330 2026] [:error] [pid 31205:tid 31216] [client 91.99.185.148:48928] [client 91.99.185.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abs4v1u5gZKGrGz5P1EZeAAAAUA"]
[Thu Mar 19 07:56:06.766293 2026] [:error] [pid 32226:tid 32247] [client 91.99.178.19:36712] [client 91.99.178.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abs7lrBb58lgPwqxC6qMvQAAAxM"]
[Thu Mar 19 08:55:59.858637 2026] [:error] [pid 32226:tid 32242] [client 159.69.124.159:34720] [client 159.69.124.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abtJn7Bb58lgPwqxC6qoVAAAAw4"]
[Thu Mar 19 09:59:54.560803 2026] [:error] [pid 23884:tid 23963] [client 209.87.169.242:31955] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "abtYml6St-VCdOYnZMokZAAAAIc"]
[Thu Mar 19 09:59:55.341287 2026] [:error] [pid 25269:tid 25282] [client 209.87.169.45:56771] [client 209.87.169.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "abtYm8U9ntriqNcU-b6InwAAA8o"]
[Thu Mar 19 09:59:56.714662 2026] [:error] [pid 23988:tid 24008] [client 209.87.169.44:43583] [client 209.87.169.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "abtYnGnlkSPXj2matr0uqQAAANE"]
[Thu Mar 19 10:00:53.242983 2026] [:error] [pid 25044:tid 25064] [client 209.87.169.34:62495] [client 209.87.169.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "abtY1dUUDKsY7wMywpo03QAAAtA"]
[Thu Mar 19 10:00:54.613307 2026] [:error] [pid 25179:tid 25198] [client 45.131.195.236:65361] [client 45.131.195.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "abtY1mFzmTtmuBLc_LZTmQAAA5E"]
[Thu Mar 19 10:00:56.627104 2026] [:error] [pid 25269:tid 25281] [client 209.87.169.42:53605] [client 209.87.169.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "abtY2MU9ntriqNcU-b6KzwAAA8k"]
[Thu Mar 19 10:00:57.371268 2026] [:error] [pid 32226:tid 32243] [client 209.87.169.241:22597] [client 209.87.169.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "abtY2bBb58lgPwqxC6rNJQAAAw8"]
[Thu Mar 19 10:00:59.278637 2026] [:error] [pid 24925:tid 24946] [client 209.87.169.241:55113] [client 209.87.169.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "abtY2_UZEHbnUgjEbWNANAAAAZE"]
[Thu Mar 19 10:00:59.799104 2026] [:error] [pid 23884:tid 23960] [client 209.87.169.219:27895] [client 209.87.169.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "abtY216St-VCdOYnZMoleQAAAIQ"]
[Thu Mar 19 10:01:00.343605 2026] [:error] [pid 23884:tid 23960] [client 209.87.169.253:51673] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "abtY3F6St-VCdOYnZMolfQAAAIQ"]
[Thu Mar 19 10:01:00.927777 2026] [:error] [pid 23988:tid 24015] [client 209.87.169.229:54643] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "abtY3GnlkSPXj2matr0wigAAANg"]
[Thu Mar 19 10:01:01.414088 2026] [:error] [pid 25179:tid 25195] [client 209.87.169.223:63747] [client 209.87.169.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "abtY3WFzmTtmuBLc_LZUAAAAA44"]
[Thu Mar 19 10:01:03.960856 2026] [:error] [pid 24971:tid 24986] [client 209.87.169.229:44129] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "abtY3_UcWA7YXQC7dRvOrQAAAks"]
[Thu Mar 19 10:01:05.339500 2026] [:error] [pid 24971:tid 24991] [client 209.87.169.210:47795] [client 209.87.169.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "abtY4fUcWA7YXQC7dRvO5AAAAlA"]
[Thu Mar 19 10:01:06.971181 2026] [:error] [pid 31735:tid 31761] [client 209.87.169.38:64949] [client 209.87.169.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "abtY4n-gyQbRQWJYccxGrwAAApY"]
[Thu Mar 19 10:01:07.494491 2026] [:error] [pid 23882:tid 23922] [client 209.87.169.239:27301] [client 209.87.169.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "abtY47WnClbtbN12M78fdQAAABQ"]
[Thu Mar 19 10:01:17.925193 2026] [:error] [pid 23988:tid 24000] [client 209.87.169.68:58453] [client 209.87.169.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "abtY7WnlkSPXj2matr0wtgAAAMk"]
[Thu Mar 19 10:01:19.579692 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.220:36729] [client 209.87.169.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "abtY7_UZEHbnUgjEbWNAgAAAAYM"]
[Thu Mar 19 10:01:22.549722 2026] [:error] [pid 23884:tid 23980] [client 209.87.169.242:36261] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "abtY8l6St-VCdOYnZMol1QAAAJg"]
[Thu Mar 19 10:01:31.620721 2026] [:error] [pid 31205:tid 31222] [client 209.87.169.210:34213] [client 209.87.169.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "abtY-1u5gZKGrGz5P1FSdwAAAUY"]
[Thu Mar 19 10:01:40.509090 2026] [:error] [pid 23988:tid 24008] [client 209.87.169.238:36055] [client 209.87.169.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abtZBGnlkSPXj2matr0xHQAAANE"]
[Thu Mar 19 12:54:13.395521 2026] [:error] [pid 24925:tid 24942] [client 154.16.49.101:6593] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abuBdfUZEHbnUgjEbWNmvAAAAY0"]
[Thu Mar 19 12:54:13.888721 2026] [:error] [pid 25269:tid 25294] [client 154.16.49.101:6744] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBdcU9ntriqNcU-b7DeAAAA9Y"]
[Thu Mar 19 12:54:14.381325 2026] [:error] [pid 31205:tid 31230] [client 154.16.49.101:6930] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feed/"] [unique_id "abuBdlu5gZKGrGz5P1Gn3AAAAU0"]
[Thu Mar 19 13:24:21.591464 2026] [:error] [pid 24925:tid 24949] [client 103.171.247.168:31821] [client 103.171.247.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.247.168, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abuIhfUZEHbnUgjEbWNshQAAAZQ"]
[Thu Mar 19 13:24:26.085992 2026] [:error] [pid 25135:tid 25146] [client 106.213.85.115:27063] [client 106.213.85.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.85.115, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abuIiqKtE0dzgMctjFX7KAAAA0k"]
[Thu Mar 19 15:47:16.847652 2026] [:error] [pid 48106:tid 48138] [client 43.166.128.86:53806] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abuqBMVZaUGvkz29lZHldQAAANg"]
[Thu Mar 19 17:34:36.482776 2026] [:error] [pid 1247:tid 1257] [client 106.227.49.113:54158] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abvDLA5tmeOr-yI4XNGErAAAAcg"]
[Thu Mar 19 21:08:48.841537 2026] [:error] [pid 11110:tid 11119] [client 43.153.87.54:35362] [client 43.153.87.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abv1YASNPqGfikw7k8K-BQAAAAQ"]
[Thu Mar 19 23:52:22.809857 2026] [:error] [pid 11016:tid 11082] [client 43.154.250.181:57604] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abwbthPK94J9G19C6uVh2wAAAQk"]
[Thu Mar 19 23:59:20.329143 2026] [:error] [pid 1441:tid 1462] [client 20.104.192.115:22244] [client 20.104.192.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.192.115, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abwdWIf6BGzjfVNuehUoeAAAAxI"]
[Thu Mar 19 23:59:26.099518 2026] [:error] [pid 1441:tid 1446] [client 20.104.192.115:22244] [client 20.104.192.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abwdXof6BGzjfVNuehUoiwAAAwM"]
[Thu Mar 19 23:59:31.147410 2026] [:error] [pid 1247:tid 1269] [client 20.104.192.115:22475] [client 20.104.192.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "abwdYw5tmeOr-yI4XNEvsgAAAdQ"]
[Fri Mar 20 01:14:32.563012 2026] [:error] [pid 46264:tid 46301] [client 209.97.171.56:62816] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "abwu-Ip3TruHFmWOt5HW2gAAABI"]
[Fri Mar 20 01:14:49.898884 2026] [:error] [pid 46124:tid 46201] [client 115.69.249.3:3467] [client 115.69.249.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.69.249.3, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "abwvCUzMrlLOY6zyCjJ2fwAAAFU"]
[Fri Mar 20 01:16:33.638879 2026] [:error] [pid 46125:tid 46210] [client 104.28.246.117:44165] [client 104.28.246.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "abwvcWgN4lI6NHeckY5cwQAAAIE"]
[Fri Mar 20 01:16:37.095509 2026] [:error] [pid 46126:tid 46214] [client 104.28.246.117:62361] [client 104.28.246.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/style.php"] [unique_id "abwvdaQ44YePbsZz3j7NFQAAAQI"]
[Fri Mar 20 01:16:40.543594 2026] [:error] [pid 46126:tid 46236] [client 104.28.246.117:24586] [client 104.28.246.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/themes/style.php"] [unique_id "abwveKQ44YePbsZz3j7NGwAAAQ0"]
[Fri Mar 20 10:47:22.723886 2026] [:error] [pid 49170:tid 49179] [client 43.166.247.82:37346] [client 43.166.247.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aby1Os-c8ctLVDCqUJXFdgAAAAU"]
[Fri Mar 20 14:03:49.345111 2026] [:error] [pid 49081:tid 49138] [client 182.44.8.254:52512] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "abzjRRo1LBAUhfhYPR2zOgAAARc"]
[Fri Mar 20 14:11:46.129054 2026] [:error] [pid 49080:tid 49086] [client 185.198.240.44:36327] [client 185.198.240.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.44, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "abzlIok5CHi4V0A3tthgSwAAAEA"]
[Fri Mar 20 17:20:52.448380 2026] [:error] [pid 27302:tid 27319] [client 43.157.180.116:42808] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab0RdLDKiUve17xv6yFFFQAAAM8"]
[Fri Mar 20 18:28:16.350963 2026] [:error] [pid 49081:tid 49137] [client 49.37.161.192:65186] [client 49.37.161.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.161.192, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab0hQBo1LBAUhfhYPR1duAAAARY"]
[Fri Mar 20 19:16:34.020349 2026] [:error] [pid 49080:tid 49089] [client 106.219.192.234:4480] [client 106.219.192.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.192.234, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab0skok5CHi4V0A3ttjymQAAAEM"]
[Fri Mar 20 20:02:54.482422 2026] [:error] [pid 49170:tid 49194] [client 170.106.35.187:35658] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab03bs-c8ctLVDCqUJV6gQAAABQ"]
[Fri Mar 20 20:05:45.318357 2026] [:error] [pid 27302:tid 27324] [client 82.64.128.248:37146] [client 82.64.128.248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/../.env"] [unique_id "ab04GbDKiUve17xv6yF4QAAAANQ"]
[Fri Mar 20 20:13:30.240092 2026] [:error] [pid 51714:tid 51734] [client 216.24.212.23:55333] [client 216.24.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.23, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ab056jWI82pxvQ0gksvhZAAAAJI"]
[Fri Mar 20 21:21:19.809407 2026] [:error] [pid 49082:tid 49166] [client 1.15.52.154:38294] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab1Jz6pllYJI1LUIdL_RkgAAAVg"]
[Fri Mar 20 22:40:45.457942 2026] [:error] [pid 49082:tid 49145] [client 43.159.145.149:50830] [client 43.159.145.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab1cbapllYJI1LUIdL_0JwAAAUM"]
[Sat Mar 21 02:20:39.410346 2026] [:error] [pid 62479:tid 62526] [client 43.157.158.178:33660] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab2P9_KZ7MVNG8qirU9ucQAAAQ8"]
[Sat Mar 21 04:36:00.153072 2026] [:error] [pid 1489:tid 1515] [client 221.229.106.25:58862] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab2vsFRvnvBO_DG9kxvptgAAAAs"]
[Sat Mar 21 07:57:58.746770 2026] [:error] [pid 33348:tid 33357] [client 43.130.40.120:49010] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab3fBjEj9d9zzbs_KjjWywAAAUY"]
[Sat Mar 21 09:18:03.977164 2026] [:error] [pid 43052:tid 43063] [client 43.157.187.11:62987] [client 43.157.187.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab3xy15fjm-AiInC1hLpYgAAA4k"]
[Sat Mar 21 09:18:04.685639 2026] [:error] [pid 43052:tid 43073] [client 43.157.187.11:55118] [client 43.157.187.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ab3xzF5fjm-AiInC1hLpaAAAA5M"]
[Sat Mar 21 09:18:05.400373 2026] [:error] [pid 1489:tid 1528] [client 43.157.187.11:61323] [client 43.157.187.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "ab3xzVRvnvBO_DG9kxsmLAAAABg"]
[Sat Mar 21 10:10:25.109777 2026] [:error] [pid 1489:tid 1521] [client 14.191.130.186:22880] [client 14.191.130.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.191.130.186, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab3-EVRvnvBO_DG9kxs5OQAAABE"]
[Sat Mar 21 11:19:37.497113 2026] [:error] [pid 1491:tid 1563] [client 117.33.163.216:47992] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab4OSa3VfHftzE9w9t4eUQAAAIA"]
[Sat Mar 21 12:15:00.594251 2026] [:error] [pid 43052:tid 43055] [client 43.166.131.228:34186] [client 43.166.131.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab4bRF5fjm-AiInC1hI97wAAA4E"]
[Sat Mar 21 14:02:19.240757 2026] [:error] [pid 1489:tid 1505] [client 103.225.244.141:6503] [client 103.225.244.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.225.244.141, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab40a1RvnvBO_DG9kxuKBAAAAAI"]
[Sat Mar 21 15:34:57.082070 2026] [:error] [pid 43052:tid 43066] [client 43.155.129.131:34222] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab5KIV5fjm-AiInC1hKfpQAAA4w"]
[Sat Mar 21 17:27:44.253870 2026] [:error] [pid 1490:tid 1558] [client 42.119.182.129:52488] [client 42.119.182.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.119.182.129, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab5kkGSWhIPTatyxDeAwqQAAAFY"]
[Sat Mar 21 18:33:01.408297 2026] [:error] [pid 33678:tid 33702] [client 49.51.253.26:50942] [client 49.51.253.26] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab5z3TuClB_om73sXhdb3gAAAhY"]
[Sat Mar 21 18:35:52.286771 2026] [:error] [pid 1490:tid 1544] [client 182.42.104.32:49536] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab50iGSWhIPTatyxDeBAGQAAAEk"]
[Sun Mar 22 01:31:13.783791 2026] [:error] [pid 40780:tid 40953] [client 54.169.201.79:63147] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab7V4SZDsmYIjKpJe4NSGAAAAAY"]
[Sun Mar 22 01:31:14.016059 2026] [:error] [pid 40780:tid 40956] [client 54.169.201.79:65007] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ab7V4iZDsmYIjKpJe4NSGQAAAAk"]
[Sun Mar 22 01:31:14.192536 2026] [:error] [pid 40780:tid 40950] [client 54.169.201.79:55242] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "ab7V4iZDsmYIjKpJe4NSHAAAAAM"]
[Sun Mar 22 02:00:48.179334 2026] [:error] [pid 40781:tid 41006] [client 182.43.70.143:54341] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab7c0DJQuCgg1YvEGBLsVQAAAEA"]
[Sun Mar 22 07:28:16.732834 2026] [:error] [pid 51363:tid 51446] [client 43.157.52.37:38138] [client 43.157.52.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab8pkFwa9x6OCTRkhl1wKgAAAJA"]
[Sun Mar 22 08:32:27.950917 2026] [:error] [pid 51468:tid 51489] [client 43.138.68.113:54794] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab84m02TppSvA8W5CBTc6QAAAM0"]
[Sun Mar 22 09:13:46.726606 2026] [:error] [pid 51362:tid 51407] [client 88.235.200.30:40550] [client 88.235.200.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.235.200.30, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab9CSsOwPm3DXzTDjUfihAAAAEY"]
[Sun Mar 22 11:30:04.806201 2026] [:error] [pid 40039:tid 40046] [client 104.28.214.122:16432] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "ab9iPB3aDgUJfBYishnaCAAAAQU"]
[Sun Mar 22 11:30:05.257247 2026] [:error] [pid 51361:tid 51392] [client 104.28.214.122:35780] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/style.php"] [unique_id "ab9iPRXYUsdvKC9YWpVwMQAAABQ"]
[Sun Mar 22 13:02:43.442374 2026] [:error] [pid 51468:tid 51500] [client 118.175.168.59:49873] [client 118.175.168.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.175.168.59, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab93802TppSvA8W5CBRdoQAAANg"]
[Sun Mar 22 14:40:57.810019 2026] [:error] [pid 51363:tid 51448] [client 43.130.139.136:36608] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ab-O-Vwa9x6OCTRkhl0DqgAAAJI"]
[Sun Mar 22 15:52:50.692155 2026] [:error] [pid 51468:tid 51493] [client 43.140.247.223:37990] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab-f0k2TppSvA8W5CBTIwAAAANE"]
[Sun Mar 22 17:48:59.761858 2026] [:error] [pid 51362:tid 51424] [client 49.51.178.45:58256] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ab-7C8OwPm3DXzTDjUdvLAAAAFc"]
[Sun Mar 22 18:35:07.211857 2026] [:error] [pid 51363:tid 51447] [client 20.102.53.32:22063] [client 20.102.53.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.102.53.32, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ab_F21wa9x6OCTRkhl11pgAAAJE"]
[Sun Mar 22 18:35:11.368414 2026] [:error] [pid 51363:tid 51441] [client 20.102.53.32:22063] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ab_F31wa9x6OCTRkhl11vgAAAIw"]
[Sun Mar 22 18:35:19.047290 2026] [:error] [pid 51363:tid 51433] [client 20.102.53.32:22030] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "ab_F51wa9x6OCTRkhl113gAAAIU"]
[Sun Mar 22 18:35:26.365458 2026] [:error] [pid 51362:tid 51423] [client 20.102.53.32:22070] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ab_F7sOwPm3DXzTDjUeRewAAAFY"]
[Sun Mar 22 18:35:34.261361 2026] [:error] [pid 51362:tid 51400] [client 20.102.53.32:21698] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "ab_F9sOwPm3DXzTDjUeRkwAAAEA"]
[Sun Mar 22 20:25:44.694384 2026] [:error] [pid 51361:tid 51397] [client 117.194.231.168:62984] [client 117.194.231.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.194.231.168, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ab_fyBXYUsdvKC9YWpXiRwAAABg"]
[Sun Mar 22 23:09:58.863503 2026] [:error] [pid 51361:tid 51395] [client 119.28.140.106:45058] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acAGRhXYUsdvKC9YWpU3FwAAABY"]
[Mon Mar 23 03:42:36.877208 2026] [:error] [pid 19995:tid 20030] [client 176.28.195.193:11863] [client 176.28.195.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.28.195.193, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acBGLBo74cfxUaKpIheQMQAAAEI"]
[Mon Mar 23 05:05:45.057595 2026] [:error] [pid 57265:tid 57268] [client 170.106.73.216:38142] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acBZqWNLjPJJkhuqCsifMQAAAQE"]
[Mon Mar 23 07:51:59.346435 2026] [:error] [pid 23539:tid 23557] [client 43.153.10.13:58144] [client 43.153.10.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acCAn37Dh3qWGSpIAZWF-QAAAMk"]
[Mon Mar 23 12:42:48.622255 2026] [:error] [pid 23539:tid 23562] [client 182.44.67.97:42159] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acDEyH7Dh3qWGSpIAZXRdgAAAM4"]
[Mon Mar 23 13:16:01.522962 2026] [:error] [pid 57265:tid 57289] [client 139.135.192.106:23052] [client 139.135.192.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.135.192.106, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acDMkWNLjPJJkhuqCsiF1wAAARY"]
[Mon Mar 23 16:30:27.814058 2026] [:error] [pid 14573:tid 14596] [client 43.166.224.244:34394] [client 43.166.224.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acD6I--oSmHn3q4_J1GPrwAAAVU"]
[Mon Mar 23 19:12:35.827427 2026] [:error] [pid 35165:tid 35172] [client 43.130.71.237:39688] [client 43.130.71.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acEgI86udpN6Esk7JKvHuQAAAYQ"]
[Mon Mar 23 21:16:55.597657 2026] [:error] [pid 38306:tid 38313] [client 103.69.111.52:57975] [client 103.69.111.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.111.52, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acE9RzkL8qwu-hHc6BidRQAAAQU"]
[Mon Mar 23 21:56:07.662309 2026] [:error] [pid 52341:tid 52345] [client 49.51.233.46:48082] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acFGd6PKTBDR2u47Gb3nRQAAAUI"]
[Tue Mar 24 00:33:40.230947 2026] [:error] [pid 56237:tid 56329] [client 43.131.26.226:34118] [client 43.131.26.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acFrZAymO0MnzQb90MMPTAAAAIg"]
[Tue Mar 24 01:12:55.970707 2026] [:error] [pid 56435:tid 56502] [client 172.213.9.13:55715] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fyiiz.php"] [unique_id "acF0l8rwr-l5A-s9ryB0QQAAAQM"]
[Tue Mar 24 01:12:56.528117 2026] [:error] [pid 56236:tid 56298] [client 172.213.9.13:55073] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fyiiz.php"] [unique_id "acF0mHapFgYp0uZ8twAgeAAAAEU"]
[Tue Mar 24 01:12:57.063786 2026] [:error] [pid 56238:tid 56353] [client 172.213.9.13:55101] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fyiiz.php"] [unique_id "acF0mVSqceFAZRgPDq6ZVQAAAMU"]
[Tue Mar 24 01:12:57.580724 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:65244] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fyiiz.php"] [unique_id "acF0mcrwr-l5A-s9ryB0RgAAAQ8"]
[Tue Mar 24 01:12:58.108693 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:64858] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acF0msrwr-l5A-s9ryB0SgAAARY"]
[Tue Mar 24 01:12:58.632350 2026] [:error] [pid 56237:tid 56344] [client 172.213.9.13:53619] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acF0mgymO0MnzQb90MMjmAAAAJc"]
[Tue Mar 24 01:12:59.212837 2026] [:error] [pid 56237:tid 56339] [client 172.213.9.13:65266] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acF0mwymO0MnzQb90MMjnAAAAJI"]
[Tue Mar 24 01:12:59.852881 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:65258] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acF0m8rwr-l5A-s9ryB0VAAAARc"]
[Tue Mar 24 01:13:00.564125 2026] [:error] [pid 56237:tid 56326] [client 172.213.9.13:47514] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bywaf.php"] [unique_id "acF0nAymO0MnzQb90MMjowAAAIU"]
[Tue Mar 24 01:13:01.217453 2026] [:error] [pid 56238:tid 56356] [client 172.213.9.13:43801] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bywaf.php"] [unique_id "acF0nVSqceFAZRgPDq6ZXQAAAMg"]
[Tue Mar 24 01:13:01.795668 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:47507] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bywaf.php"] [unique_id "acF0ncrwr-l5A-s9ryB0VwAAARY"]
[Tue Mar 24 01:13:02.333528 2026] [:error] [pid 56435:tid 56520] [client 172.213.9.13:46922] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bywaf.php"] [unique_id "acF0nsrwr-l5A-s9ryB0WAAAARM"]
[Tue Mar 24 01:13:02.903324 2026] [:error] [pid 56238:tid 56372] [client 172.213.9.13:48341] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acF0nlSqceFAZRgPDq6ZZwAAANg"]
[Tue Mar 24 01:13:03.370973 2026] [:error] [pid 56435:tid 56505] [client 172.213.9.13:48379] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acF0n8rwr-l5A-s9ryB0XgAAAQY"]
[Tue Mar 24 01:13:03.920476 2026] [:error] [pid 56238:tid 56356] [client 172.213.9.13:48347] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acF0n1SqceFAZRgPDq6ZawAAAMg"]
[Tue Mar 24 01:13:04.524747 2026] [:error] [pid 56238:tid 56358] [client 172.213.9.13:50902] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acF0oFSqceFAZRgPDq6ZdAAAAMo"]
[Tue Mar 24 01:13:05.050828 2026] [:error] [pid 56236:tid 56301] [client 172.213.9.13:2468] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "acF0oXapFgYp0uZ8twAgggAAAEg"]
[Tue Mar 24 01:13:05.715661 2026] [:error] [pid 56435:tid 56521] [client 172.213.9.13:51594] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "acF0ocrwr-l5A-s9ryB0ZwAAARQ"]
[Tue Mar 24 01:13:06.297907 2026] [:error] [pid 56435:tid 56510] [client 172.213.9.13:2924] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "acF0osrwr-l5A-s9ryB0awAAAQo"]
[Tue Mar 24 01:13:06.878777 2026] [:error] [pid 56236:tid 56298] [client 172.213.9.13:44462] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "acF0onapFgYp0uZ8twAghwAAAEU"]
[Tue Mar 24 01:13:07.433701 2026] [:error] [pid 56236:tid 56304] [client 172.213.9.13:3038] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/erty.php"] [unique_id "acF0o3apFgYp0uZ8twAgiwAAAEs"]
[Tue Mar 24 01:13:07.941245 2026] [:error] [pid 56236:tid 56314] [client 172.213.9.13:63963] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/erty.php"] [unique_id "acF0o3apFgYp0uZ8twAgkAAAAFU"]
[Tue Mar 24 01:13:08.522087 2026] [:error] [pid 56238:tid 56367] [client 172.213.9.13:45054] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/erty.php"] [unique_id "acF0pFSqceFAZRgPDq6ZkQAAANM"]
[Tue Mar 24 01:13:09.035032 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:51608] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/erty.php"] [unique_id "acF0pcrwr-l5A-s9ryB0cwAAAQ8"]
[Tue Mar 24 01:13:09.549281 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:50937] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acF0pcrwr-l5A-s9ryB0dwAAARU"]
[Tue Mar 24 01:13:10.088074 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:55101] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acF0psrwr-l5A-s9ryB0egAAARE"]
[Tue Mar 24 01:13:10.637981 2026] [:error] [pid 56435:tid 56507] [client 172.213.9.13:44450] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acF0psrwr-l5A-s9ryB0gAAAAQc"]
[Tue Mar 24 01:13:11.103577 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:45049] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acF0p8rwr-l5A-s9ryB0hgAAARU"]
[Tue Mar 24 01:13:11.625875 2026] [:error] [pid 56238:tid 56353] [client 172.213.9.13:51589] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wgift1.php"] [unique_id "acF0p1SqceFAZRgPDq6ZmAAAAMU"]
[Tue Mar 24 01:13:12.170411 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:2937] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wgift1.php"] [unique_id "acF0qMrwr-l5A-s9ryB0jgAAARA"]
[Tue Mar 24 01:13:12.706748 2026] [:error] [pid 56236:tid 56311] [client 172.213.9.13:3009] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wgift1.php"] [unique_id "acF0qHapFgYp0uZ8twAgnAAAAFI"]
[Tue Mar 24 01:13:13.175285 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:63957] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wgift1.php"] [unique_id "acF0qcrwr-l5A-s9ryB0lgAAARE"]
[Tue Mar 24 01:13:13.700070 2026] [:error] [pid 56237:tid 56344] [client 172.213.9.13:62289] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rithin.php"] [unique_id "acF0qQymO0MnzQb90MMjugAAAJc"]
[Tue Mar 24 01:13:14.236437 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:50916] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rithin.php"] [unique_id "acF0qlSqceFAZRgPDq6ZnAAAANQ"]
[Tue Mar 24 01:13:14.753422 2026] [:error] [pid 56435:tid 56511] [client 172.213.9.13:62331] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rithin.php"] [unique_id "acF0qsrwr-l5A-s9ryB0oQAAAQs"]
[Tue Mar 24 01:13:15.252310 2026] [:error] [pid 56238:tid 56364] [client 172.213.9.13:47976] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rithin.php"] [unique_id "acF0q1SqceFAZRgPDq6ZogAAANA"]
[Tue Mar 24 01:13:15.778010 2026] [:error] [pid 56237:tid 56324] [client 172.213.9.13:3071] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acF0qwymO0MnzQb90MMjwAAAAIM"]
[Tue Mar 24 01:13:16.279270 2026] [:error] [pid 56236:tid 56302] [client 172.213.9.13:44457] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acF0rHapFgYp0uZ8twAgnwAAAEk"]
[Tue Mar 24 01:13:16.782101 2026] [:error] [pid 56238:tid 56348] [client 172.213.9.13:47967] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acF0rFSqceFAZRgPDq6ZrQAAAMA"]
[Tue Mar 24 01:13:17.286090 2026] [:error] [pid 56236:tid 56310] [client 172.213.9.13:63948] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acF0rXapFgYp0uZ8twAgoAAAAFE"]
[Tue Mar 24 01:13:17.778149 2026] [:error] [pid 56236:tid 56305] [client 172.213.9.13:50933] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class.php"] [unique_id "acF0rXapFgYp0uZ8twAgogAAAEw"]
[Tue Mar 24 01:13:18.267398 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:48380] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class.php"] [unique_id "acF0rsrwr-l5A-s9ryB0qgAAAQ8"]
[Tue Mar 24 01:13:18.765791 2026] [:error] [pid 56236:tid 56297] [client 172.213.9.13:47984] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class.php"] [unique_id "acF0rnapFgYp0uZ8twAgqQAAAEQ"]
[Tue Mar 24 01:13:19.251121 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:50914] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class.php"] [unique_id "acF0r8rwr-l5A-s9ryB0rgAAARY"]
[Tue Mar 24 01:13:19.755472 2026] [:error] [pid 56435:tid 56504] [client 172.213.9.13:48265] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwq13.php"] [unique_id "acF0r8rwr-l5A-s9ryB0tAAAAQU"]
[Tue Mar 24 01:13:20.246884 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:62292] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwq13.php"] [unique_id "acF0sMrwr-l5A-s9ryB0uAAAARA"]
[Tue Mar 24 01:13:20.765711 2026] [:error] [pid 56238:tid 56369] [client 172.213.9.13:44471] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwq13.php"] [unique_id "acF0sFSqceFAZRgPDq6ZuAAAANU"]
[Tue Mar 24 01:13:21.282744 2026] [:error] [pid 56435:tid 56504] [client 172.213.9.13:44430] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwq13.php"] [unique_id "acF0scrwr-l5A-s9ryB0xAAAAQU"]
[Tue Mar 24 01:13:21.783305 2026] [:error] [pid 56238:tid 56372] [client 172.213.9.13:2441] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aapig.php"] [unique_id "acF0sVSqceFAZRgPDq6ZuwAAANg"]
[Tue Mar 24 01:13:22.274438 2026] [:error] [pid 56435:tid 56519] [client 172.213.9.13:44474] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aapig.php"] [unique_id "acF0ssrwr-l5A-s9ryB0yAAAARI"]
[Tue Mar 24 01:13:22.778911 2026] [:error] [pid 56238:tid 56358] [client 172.213.9.13:2942] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aapig.php"] [unique_id "acF0slSqceFAZRgPDq6ZwQAAAMo"]
[Tue Mar 24 01:13:23.271967 2026] [:error] [pid 56435:tid 56520] [client 172.213.9.13:3046] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aapig.php"] [unique_id "acF0s8rwr-l5A-s9ryB0zAAAARM"]
[Tue Mar 24 01:13:23.754164 2026] [:error] [pid 56435:tid 56500] [client 172.213.9.13:51636] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/webadmin.php"] [unique_id "acF0s8rwr-l5A-s9ryB00AAAAQE"]
[Tue Mar 24 01:13:24.222911 2026] [:error] [pid 56238:tid 56362] [client 172.213.9.13:48377] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/webadmin.php"] [unique_id "acF0tFSqceFAZRgPDq6ZzgAAAM4"]
[Tue Mar 24 01:13:24.724758 2026] [:error] [pid 56238:tid 56349] [client 172.213.9.13:63982] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/webadmin.php"] [unique_id "acF0tFSqceFAZRgPDq6Z1AAAAME"]
[Tue Mar 24 01:13:25.228341 2026] [:error] [pid 56435:tid 56502] [client 172.213.9.13:63992] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/webadmin.php"] [unique_id "acF0tcrwr-l5A-s9ryB00wAAAQM"]
[Tue Mar 24 01:13:25.726442 2026] [:error] [pid 56435:tid 56508] [client 172.213.9.13:2921] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xc0252.php"] [unique_id "acF0tcrwr-l5A-s9ryB02AAAAQg"]
[Tue Mar 24 01:13:26.206484 2026] [:error] [pid 56238:tid 56372] [client 172.213.9.13:2942] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xc0252.php"] [unique_id "acF0tlSqceFAZRgPDq6Z4AAAANg"]
[Tue Mar 24 01:13:26.699806 2026] [:error] [pid 56238:tid 56370] [client 172.213.9.13:2884] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xc0252.php"] [unique_id "acF0tlSqceFAZRgPDq6Z6AAAANY"]
[Tue Mar 24 01:13:27.180302 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:51611] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xc0252.php"] [unique_id "acF0t8rwr-l5A-s9ryB03QAAAQ4"]
[Tue Mar 24 01:13:27.655366 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:63991] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws84.php"] [unique_id "acF0t1SqceFAZRgPDq6Z7QAAANQ"]
[Tue Mar 24 01:13:28.142282 2026] [:error] [pid 56237:tid 56337] [client 172.213.9.13:51617] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws84.php"] [unique_id "acF0uAymO0MnzQb90MMj1gAAAJA"]
[Tue Mar 24 01:13:28.636966 2026] [:error] [pid 56238:tid 56357] [client 172.213.9.13:50925] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws84.php"] [unique_id "acF0uFSqceFAZRgPDq6Z9AAAAMk"]
[Tue Mar 24 01:13:29.150623 2026] [:error] [pid 56238:tid 56366] [client 172.213.9.13:51610] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws84.php"] [unique_id "acF0uVSqceFAZRgPDq6Z9wAAANI"]
[Tue Mar 24 01:13:29.698114 2026] [:error] [pid 56238:tid 56371] [client 172.213.9.13:44472] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sc.php"] [unique_id "acF0uVSqceFAZRgPDq6Z_wAAANc"]
[Tue Mar 24 01:13:30.170581 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:48259] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sc.php"] [unique_id "acF0ulSqceFAZRgPDq6aAQAAANQ"]
[Tue Mar 24 01:13:30.649403 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:48264] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sc.php"] [unique_id "acF0usrwr-l5A-s9ryB08AAAARY"]
[Tue Mar 24 01:13:31.134055 2026] [:error] [pid 56435:tid 56501] [client 172.213.9.13:62307] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sc.php"] [unique_id "acF0u8rwr-l5A-s9ryB09gAAAQI"]
[Tue Mar 24 01:13:31.606771 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:3031] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mis.php"] [unique_id "acF0u8rwr-l5A-s9ryB0_AAAARU"]
[Tue Mar 24 01:13:32.087948 2026] [:error] [pid 56435:tid 56502] [client 172.213.9.13:44432] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mis.php"] [unique_id "acF0vMrwr-l5A-s9ryB1AwAAAQM"]
[Tue Mar 24 01:13:32.589120 2026] [:error] [pid 56238:tid 56363] [client 172.213.9.13:63996] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mis.php"] [unique_id "acF0vFSqceFAZRgPDq6aEAAAAM8"]
[Tue Mar 24 01:13:33.075891 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:44996] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mis.php"] [unique_id "acF0vcrwr-l5A-s9ryB1CAAAARY"]
[Tue Mar 24 01:13:33.560452 2026] [:error] [pid 56238:tid 56349] [client 172.213.9.13:50926] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zogy1.php"] [unique_id "acF0vVSqceFAZRgPDq6aFgAAAME"]
[Tue Mar 24 01:13:34.031665 2026] [:error] [pid 56435:tid 56499] [client 172.213.9.13:63995] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zogy1.php"] [unique_id "acF0vsrwr-l5A-s9ryB1DwAAAQA"]
[Tue Mar 24 01:13:34.505409 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:2888] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zogy1.php"] [unique_id "acF0vsrwr-l5A-s9ryB1FQAAAQ4"]
[Tue Mar 24 01:13:34.995852 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:47958] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zogy1.php"] [unique_id "acF0vsrwr-l5A-s9ryB1GAAAARY"]
[Tue Mar 24 01:13:35.471778 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:47981] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xvs.php"] [unique_id "acF0v8rwr-l5A-s9ryB1GgAAARE"]
[Tue Mar 24 01:13:35.954828 2026] [:error] [pid 56435:tid 56507] [client 172.213.9.13:51646] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xvs.php"] [unique_id "acF0v8rwr-l5A-s9ryB1HQAAAQc"]
[Tue Mar 24 01:13:36.427177 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:63988] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xvs.php"] [unique_id "acF0wMrwr-l5A-s9ryB1HwAAAQ8"]
[Tue Mar 24 01:13:36.906310 2026] [:error] [pid 56237:tid 56333] [client 172.213.9.13:2897] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xvs.php"] [unique_id "acF0wAymO0MnzQb90MMj6gAAAIw"]
[Tue Mar 24 01:13:37.391627 2026] [:error] [pid 56238:tid 56358] [client 172.213.9.13:51605] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acF0wVSqceFAZRgPDq6aNAAAAMo"]
[Tue Mar 24 01:13:37.877202 2026] [:error] [pid 56435:tid 56502] [client 172.213.9.13:45052] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acF0wcrwr-l5A-s9ryB1JwAAAQM"]
[Tue Mar 24 01:13:38.356515 2026] [:error] [pid 56237:tid 56325] [client 172.213.9.13:2919] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acF0wgymO0MnzQb90MMj7AAAAIQ"]
[Tue Mar 24 01:13:38.830446 2026] [:error] [pid 56237:tid 56331] [client 172.213.9.13:47990] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acF0wgymO0MnzQb90MMj7gAAAIo"]
[Tue Mar 24 01:13:39.298524 2026] [:error] [pid 56435:tid 56509] [client 172.213.9.13:45005] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acF0w8rwr-l5A-s9ryB1LQAAAQk"]
[Tue Mar 24 01:13:39.786797 2026] [:error] [pid 56237:tid 56321] [client 172.213.9.13:44465] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acF0wwymO0MnzQb90MMj8wAAAIA"]
[Tue Mar 24 01:13:40.324409 2026] [:error] [pid 56238:tid 56371] [client 172.213.9.13:44993] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acF0xFSqceFAZRgPDq6aRwAAANc"]
[Tue Mar 24 01:13:40.799991 2026] [:error] [pid 56237:tid 56334] [client 172.213.9.13:63999] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acF0xAymO0MnzQb90MMj-QAAAI0"]
[Tue Mar 24 01:13:41.305527 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:2906] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/web.php"] [unique_id "acF0xcrwr-l5A-s9ryB1MQAAARE"]
[Tue Mar 24 01:13:41.797240 2026] [:error] [pid 56236:tid 56314] [client 172.213.9.13:50909] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/web.php"] [unique_id "acF0xXapFgYp0uZ8twAgvQAAAFU"]
[Tue Mar 24 01:13:42.268805 2026] [:error] [pid 56237:tid 56343] [client 172.213.9.13:44421] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/web.php"] [unique_id "acF0xgymO0MnzQb90MMj_wAAAJY"]
[Tue Mar 24 01:13:42.749733 2026] [:error] [pid 56237:tid 56321] [client 172.213.9.13:50915] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/web.php"] [unique_id "acF0xgymO0MnzQb90MMkAAAAAIA"]
[Tue Mar 24 01:13:43.246129 2026] [:error] [pid 56238:tid 56356] [client 172.213.9.13:51627] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acF0x1SqceFAZRgPDq6aXQAAAMg"]
[Tue Mar 24 01:13:43.734293 2026] [:error] [pid 56237:tid 56336] [client 172.213.9.13:50936] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acF0xwymO0MnzQb90MMkAwAAAI8"]
[Tue Mar 24 01:13:44.214149 2026] [:error] [pid 56238:tid 56358] [client 172.213.9.13:45046] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acF0yFSqceFAZRgPDq6aZQAAAMo"]
[Tue Mar 24 01:13:44.687224 2026] [:error] [pid 56238:tid 56362] [client 172.213.9.13:44467] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acF0yFSqceFAZRgPDq6abAAAAM4"]
[Tue Mar 24 01:13:45.178024 2026] [:error] [pid 56435:tid 56503] [client 172.213.9.13:62281] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lp6.php"] [unique_id "acF0ycrwr-l5A-s9ryB1NQAAAQQ"]
[Tue Mar 24 01:13:45.661201 2026] [:error] [pid 56237:tid 56341] [client 172.213.9.13:3054] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lp6.php"] [unique_id "acF0yQymO0MnzQb90MMkCAAAAJQ"]
[Tue Mar 24 01:13:46.161076 2026] [:error] [pid 56238:tid 56352] [client 172.213.9.13:47995] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lp6.php"] [unique_id "acF0ylSqceFAZRgPDq6aeAAAAMQ"]
[Tue Mar 24 01:13:46.654509 2026] [:error] [pid 56238:tid 56367] [client 172.213.9.13:51615] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lp6.php"] [unique_id "acF0ylSqceFAZRgPDq6afAAAANM"]
[Tue Mar 24 01:13:47.155875 2026] [:error] [pid 56237:tid 56332] [client 172.213.9.13:3016] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/com.php"] [unique_id "acF0ywymO0MnzQb90MMkDwAAAIs"]
[Tue Mar 24 01:13:47.628319 2026] [:error] [pid 56238:tid 56357] [client 172.213.9.13:48269] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/com.php"] [unique_id "acF0y1SqceFAZRgPDq6agQAAAMk"]
[Tue Mar 24 01:13:48.098182 2026] [:error] [pid 56238:tid 56358] [client 172.213.9.13:2910] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/com.php"] [unique_id "acF0zFSqceFAZRgPDq6ahQAAAMo"]
[Tue Mar 24 01:13:48.573512 2026] [:error] [pid 56238:tid 56367] [client 172.213.9.13:62335] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/com.php"] [unique_id "acF0zFSqceFAZRgPDq6aiwAAANM"]
[Tue Mar 24 01:13:49.046123 2026] [:error] [pid 56238:tid 56364] [client 172.213.9.13:63936] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acF0zVSqceFAZRgPDq6akwAAANA"]
[Tue Mar 24 01:13:49.526142 2026] [:error] [pid 56238:tid 56362] [client 172.213.9.13:51593] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acF0zVSqceFAZRgPDq6amwAAAM4"]
[Tue Mar 24 01:13:50.003589 2026] [:error] [pid 56435:tid 56509] [client 172.213.9.13:3063] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acF0zsrwr-l5A-s9ryB1RQAAAQk"]
[Tue Mar 24 01:13:50.479824 2026] [:error] [pid 56237:tid 56325] [client 172.213.9.13:47962] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acF0zgymO0MnzQb90MMkFQAAAIQ"]
[Tue Mar 24 01:13:50.945455 2026] [:error] [pid 56238:tid 56363] [client 172.213.9.13:63974] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wander.php"] [unique_id "acF0zlSqceFAZRgPDq6aqwAAAM8"]
[Tue Mar 24 01:13:51.423631 2026] [:error] [pid 56238:tid 56354] [client 172.213.9.13:2454] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wander.php"] [unique_id "acF0z1SqceFAZRgPDq6asAAAAMY"]
[Tue Mar 24 01:13:51.896330 2026] [:error] [pid 56238:tid 56372] [client 172.213.9.13:47956] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wander.php"] [unique_id "acF0z1SqceFAZRgPDq6atgAAANg"]
[Tue Mar 24 01:13:52.370453 2026] [:error] [pid 56238:tid 56359] [client 172.213.9.13:45002] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wander.php"] [unique_id "acF00FSqceFAZRgPDq6avAAAAMs"]
[Tue Mar 24 01:13:52.857305 2026] [:error] [pid 56238:tid 56352] [client 172.213.9.13:45050] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acF00FSqceFAZRgPDq6awwAAAMQ"]
[Tue Mar 24 01:13:53.359093 2026] [:error] [pid 56435:tid 56502] [client 172.213.9.13:51604] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acF00crwr-l5A-s9ryB1TQAAAQM"]
[Tue Mar 24 01:13:53.849285 2026] [:error] [pid 56236:tid 56302] [client 172.213.9.13:62280] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acF00XapFgYp0uZ8twAgywAAAEk"]
[Tue Mar 24 01:14:09.891598 2026] [:error] [pid 56238:tid 56365] [client 172.213.9.13:62285] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feokc.php"] [unique_id "acF04VSqceFAZRgPDq6bRQAAANE"]
[Tue Mar 24 01:14:10.369326 2026] [:error] [pid 56236:tid 56308] [client 172.213.9.13:47968] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feokc.php"] [unique_id "acF04napFgYp0uZ8twAg6AAAAE8"]
[Tue Mar 24 01:14:10.840180 2026] [:error] [pid 56238:tid 56350] [client 172.213.9.13:62276] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feokc.php"] [unique_id "acF04lSqceFAZRgPDq6bTQAAAMI"]
[Tue Mar 24 01:14:11.315999 2026] [:error] [pid 56236:tid 56314] [client 172.213.9.13:45006] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feokc.php"] [unique_id "acF043apFgYp0uZ8twAg7wAAAFU"]
[Tue Mar 24 01:14:11.810636 2026] [:error] [pid 56238:tid 56361] [client 172.213.9.13:48256] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "acF041SqceFAZRgPDq6bUAAAAM0"]
[Tue Mar 24 01:14:12.296350 2026] [:error] [pid 56237:tid 56323] [client 172.213.9.13:50893] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "acF05AymO0MnzQb90MMkSQAAAII"]
[Tue Mar 24 01:14:12.779316 2026] [:error] [pid 56238:tid 56355] [client 172.213.9.13:2901] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "acF05FSqceFAZRgPDq6bWQAAAMc"]
[Tue Mar 24 01:14:13.267457 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:46926] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nc4.php"] [unique_id "acF05crwr-l5A-s9ryB1fgAAARA"]
[Tue Mar 24 01:14:13.743249 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:44996] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp9.php"] [unique_id "acF05crwr-l5A-s9ryB1ggAAAQ4"]
[Tue Mar 24 01:14:14.223050 2026] [:error] [pid 56238:tid 56365] [client 172.213.9.13:47948] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp9.php"] [unique_id "acF05lSqceFAZRgPDq6bXwAAANE"]
[Tue Mar 24 01:14:14.701875 2026] [:error] [pid 56236:tid 56298] [client 172.213.9.13:51600] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp9.php"] [unique_id "acF05napFgYp0uZ8twAg9gAAAEU"]
[Tue Mar 24 01:14:15.194844 2026] [:error] [pid 56238:tid 56350] [client 172.213.9.13:50896] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp9.php"] [unique_id "acF051SqceFAZRgPDq6bYgAAAMI"]
[Tue Mar 24 01:14:15.679927 2026] [:error] [pid 56238:tid 56358] [client 172.213.9.13:50911] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acF051SqceFAZRgPDq6bYwAAAMo"]
[Tue Mar 24 01:14:16.159901 2026] [:error] [pid 56237:tid 56342] [client 172.213.9.13:45053] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acF06AymO0MnzQb90MMkUwAAAJU"]
[Tue Mar 24 01:14:16.670497 2026] [:error] [pid 56237:tid 56324] [client 172.213.9.13:50880] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acF06AymO0MnzQb90MMkVQAAAIM"]
[Tue Mar 24 01:14:17.170729 2026] [:error] [pid 56435:tid 56514] [client 172.213.9.13:2899] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acF06crwr-l5A-s9ryB1jwAAAQ0"]
[Tue Mar 24 01:14:17.644077 2026] [:error] [pid 56236:tid 56309] [client 172.213.9.13:47497] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs.php"] [unique_id "acF06XapFgYp0uZ8twAg_gAAAFA"]
[Tue Mar 24 01:14:18.130903 2026] [:error] [pid 56435:tid 56502] [client 172.213.9.13:2918] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs.php"] [unique_id "acF06srwr-l5A-s9ryB1mAAAAQM"]
[Tue Mar 24 01:14:18.622038 2026] [:error] [pid 56237:tid 56337] [client 172.213.9.13:48318] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs.php"] [unique_id "acF06gymO0MnzQb90MMkWQAAAJA"]
[Tue Mar 24 01:14:19.190573 2026] [:error] [pid 56237:tid 56333] [client 172.213.9.13:50891] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs.php"] [unique_id "acF06wymO0MnzQb90MMkXgAAAIw"]
[Tue Mar 24 01:14:19.669864 2026] [:error] [pid 56237:tid 56341] [client 172.213.9.13:51606] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acF06wymO0MnzQb90MMkZAAAAJQ"]
[Tue Mar 24 01:14:20.184028 2026] [:error] [pid 56237:tid 56332] [client 172.213.9.13:3039] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acF07AymO0MnzQb90MMkaQAAAIs"]
[Tue Mar 24 01:14:20.657883 2026] [:error] [pid 56237:tid 56326] [client 172.213.9.13:47993] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acF07AymO0MnzQb90MMkawAAAIU"]
[Tue Mar 24 01:14:21.125807 2026] [:error] [pid 56435:tid 56501] [client 172.213.9.13:62325] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acF07crwr-l5A-s9ryB1nQAAAQI"]
[Tue Mar 24 01:14:21.628860 2026] [:error] [pid 56236:tid 56302] [client 172.213.9.13:2929] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acF07XapFgYp0uZ8twAhBwAAAEk"]
[Tue Mar 24 01:14:22.109164 2026] [:error] [pid 56236:tid 56305] [client 172.213.9.13:3070] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acF07napFgYp0uZ8twAhCgAAAEw"]
[Tue Mar 24 01:14:22.600063 2026] [:error] [pid 56435:tid 56505] [client 172.213.9.13:45031] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acF07srwr-l5A-s9ryB1oQAAAQY"]
[Tue Mar 24 01:14:23.087665 2026] [:error] [pid 56236:tid 56298] [client 172.213.9.13:51630] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acF073apFgYp0uZ8twAhDwAAAEU"]
[Tue Mar 24 01:14:23.580344 2026] [:error] [pid 56238:tid 56356] [client 172.213.9.13:2916] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws49.php"] [unique_id "acF071SqceFAZRgPDq6bZQAAAMg"]
[Tue Mar 24 01:14:24.090252 2026] [:error] [pid 56237:tid 56329] [client 172.213.9.13:50910] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws49.php"] [unique_id "acF08AymO0MnzQb90MMkdwAAAIg"]
[Tue Mar 24 01:14:24.571793 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:2387] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws49.php"] [unique_id "acF08Mrwr-l5A-s9ryB1qgAAARU"]
[Tue Mar 24 01:14:25.059726 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:44423] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws49.php"] [unique_id "acF08crwr-l5A-s9ryB1rQAAAQ8"]
[Tue Mar 24 01:14:25.556724 2026] [:error] [pid 56435:tid 56505] [client 172.213.9.13:51623] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfd.php"] [unique_id "acF08crwr-l5A-s9ryB1tAAAAQY"]
[Tue Mar 24 01:14:26.038796 2026] [:error] [pid 56236:tid 56302] [client 172.213.9.13:44447] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfd.php"] [unique_id "acF08napFgYp0uZ8twAhFQAAAEk"]
[Tue Mar 24 01:14:26.508199 2026] [:error] [pid 56238:tid 56366] [client 172.213.9.13:2538] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfd.php"] [unique_id "acF08lSqceFAZRgPDq6bagAAANI"]
[Tue Mar 24 01:14:26.995547 2026] [:error] [pid 56236:tid 56305] [client 172.213.9.13:50890] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gfd.php"] [unique_id "acF08napFgYp0uZ8twAhFwAAAEw"]
[Tue Mar 24 01:14:27.499872 2026] [:error] [pid 56435:tid 56503] [client 172.213.9.13:2882] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/callback.php"] [unique_id "acF088rwr-l5A-s9ryB1wAAAAQQ"]
[Tue Mar 24 01:14:27.991699 2026] [:error] [pid 56435:tid 56520] [client 172.213.9.13:51635] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/callback.php"] [unique_id "acF088rwr-l5A-s9ryB1xgAAARM"]
[Tue Mar 24 01:14:28.496598 2026] [:error] [pid 56236:tid 56293] [client 172.213.9.13:45010] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/callback.php"] [unique_id "acF09HapFgYp0uZ8twAhGwAAAEA"]
[Tue Mar 24 01:14:28.998069 2026] [:error] [pid 56237:tid 56327] [client 172.213.9.13:48362] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/callback.php"] [unique_id "acF09AymO0MnzQb90MMkkwAAAIY"]
[Tue Mar 24 01:14:29.474561 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:45039] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acF09crwr-l5A-s9ryB1ywAAARU"]
[Tue Mar 24 01:14:29.956530 2026] [:error] [pid 56237:tid 56321] [client 172.213.9.13:2939] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acF09QymO0MnzQb90MMkmAAAAIA"]
[Tue Mar 24 01:14:30.451149 2026] [:error] [pid 56238:tid 56359] [client 172.213.9.13:63972] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acF09lSqceFAZRgPDq6bcgAAAMs"]
[Tue Mar 24 01:14:30.936356 2026] [:error] [pid 56237:tid 56340] [client 172.213.9.13:45035] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acF09gymO0MnzQb90MMknAAAAJM"]
[Tue Mar 24 01:14:31.455826 2026] [:error] [pid 56236:tid 56303] [client 172.213.9.13:44463] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws88.php"] [unique_id "acF093apFgYp0uZ8twAhIQAAAEo"]
[Tue Mar 24 01:14:31.931097 2026] [:error] [pid 56237:tid 56330] [client 172.213.9.13:50923] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws88.php"] [unique_id "acF09wymO0MnzQb90MMknwAAAIk"]
[Tue Mar 24 01:14:32.417858 2026] [:error] [pid 56435:tid 56505] [client 172.213.9.13:45048] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws88.php"] [unique_id "acF0-Mrwr-l5A-s9ryB12gAAAQY"]
[Tue Mar 24 01:14:32.898823 2026] [:error] [pid 56236:tid 56317] [client 172.213.9.13:63952] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws88.php"] [unique_id "acF0-HapFgYp0uZ8twAhJAAAAFg"]
[Tue Mar 24 01:14:33.376674 2026] [:error] [pid 56238:tid 56348] [client 172.213.9.13:47954] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acF0-VSqceFAZRgPDq6beAAAAMA"]
[Tue Mar 24 01:14:33.868772 2026] [:error] [pid 56238:tid 56365] [client 172.213.9.13:50939] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acF0-VSqceFAZRgPDq6bewAAANE"]
[Tue Mar 24 01:14:34.374381 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:3032] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acF0-srwr-l5A-s9ryB15QAAAQ4"]
[Tue Mar 24 01:14:34.882428 2026] [:error] [pid 56237:tid 56344] [client 172.213.9.13:50907] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acF0-gymO0MnzQb90MMkqAAAAJc"]
[Tue Mar 24 01:14:35.366017 2026] [:error] [pid 56238:tid 56363] [client 172.213.9.13:3062] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "acF0-1SqceFAZRgPDq6bgAAAAM8"]
[Tue Mar 24 01:14:35.844146 2026] [:error] [pid 56435:tid 56508] [client 172.213.9.13:3034] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "acF0-8rwr-l5A-s9ryB17QAAAQg"]
[Tue Mar 24 01:14:36.342812 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:50928] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "acF0_Mrwr-l5A-s9ryB17wAAARc"]
[Tue Mar 24 01:14:36.836247 2026] [:error] [pid 56236:tid 56312] [client 172.213.9.13:42648] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "acF0_HapFgYp0uZ8twAhKgAAAFM"]
[Tue Mar 24 01:14:37.336748 2026] [:error] [pid 56236:tid 56304] [client 172.213.9.13:3065] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanda.php"] [unique_id "acF0_XapFgYp0uZ8twAhLAAAAEs"]
[Tue Mar 24 01:14:37.840580 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:44431] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanda.php"] [unique_id "acF0_crwr-l5A-s9ryB19wAAAQ4"]
[Tue Mar 24 01:14:38.314229 2026] [:error] [pid 56236:tid 56310] [client 172.213.9.13:2936] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanda.php"] [unique_id "acF0_napFgYp0uZ8twAhLgAAAFE"]
[Tue Mar 24 01:14:38.803743 2026] [:error] [pid 56238:tid 56349] [client 172.213.9.13:2895] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vanda.php"] [unique_id "acF0_lSqceFAZRgPDq6bjgAAAME"]
[Tue Mar 24 01:14:39.287846 2026] [:error] [pid 56435:tid 56511] [client 172.213.9.13:47940] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/domains.php"] [unique_id "acF0_8rwr-l5A-s9ryB1_gAAAQs"]
[Tue Mar 24 01:14:39.797360 2026] [:error] [pid 56435:tid 56510] [client 172.213.9.13:62286] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/domains.php"] [unique_id "acF0_8rwr-l5A-s9ryB2AwAAAQo"]
[Tue Mar 24 01:14:40.291774 2026] [:error] [pid 56237:tid 56323] [client 172.213.9.13:45018] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/domains.php"] [unique_id "acF1AAymO0MnzQb90MMktAAAAII"]
[Tue Mar 24 01:14:40.801065 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:45012] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/domains.php"] [unique_id "acF1AMrwr-l5A-s9ryB2BgAAARU"]
[Tue Mar 24 01:14:41.288762 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:46973] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acF1Acrwr-l5A-s9ryB2CwAAAQ8"]
[Tue Mar 24 01:14:41.769812 2026] [:error] [pid 56236:tid 56317] [client 172.213.9.13:44427] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acF1AXapFgYp0uZ8twAhNAAAAFg"]
[Tue Mar 24 01:14:42.244992 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:44424] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acF1Asrwr-l5A-s9ryB2EAAAARc"]
[Tue Mar 24 01:14:42.723383 2026] [:error] [pid 56435:tid 56509] [client 172.213.9.13:2913] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acF1Asrwr-l5A-s9ryB2FQAAAQk"]
[Tue Mar 24 01:14:43.200478 2026] [:error] [pid 56237:tid 56333] [client 172.213.9.13:47974] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zc-104.php"] [unique_id "acF1AwymO0MnzQb90MMkuAAAAIw"]
[Tue Mar 24 01:14:43.686033 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:3050] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zc-104.php"] [unique_id "acF1A8rwr-l5A-s9ryB2HgAAARA"]
[Tue Mar 24 01:14:44.180587 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:3035] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zc-104.php"] [unique_id "acF1BMrwr-l5A-s9ryB2IgAAARU"]
[Tue Mar 24 01:14:44.658426 2026] [:error] [pid 56237:tid 56340] [client 172.213.9.13:62312] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zc-104.php"] [unique_id "acF1BAymO0MnzQb90MMkuwAAAJM"]
[Tue Mar 24 01:14:45.129369 2026] [:error] [pid 56435:tid 56514] [client 172.213.9.13:45017] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rzki.php"] [unique_id "acF1Bcrwr-l5A-s9ryB2LQAAAQ0"]
[Tue Mar 24 01:14:45.601817 2026] [:error] [pid 56238:tid 56354] [client 172.213.9.13:62296] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rzki.php"] [unique_id "acF1BVSqceFAZRgPDq6bowAAAMY"]
[Tue Mar 24 01:14:46.105776 2026] [:error] [pid 56435:tid 56504] [client 172.213.9.13:51587] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rzki.php"] [unique_id "acF1Bsrwr-l5A-s9ryB2MgAAAQU"]
[Tue Mar 24 01:14:46.578653 2026] [:error] [pid 56236:tid 56306] [client 172.213.9.13:62288] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rzki.php"] [unique_id "acF1BnapFgYp0uZ8twAhOQAAAE0"]
[Tue Mar 24 01:14:47.081663 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:47997] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xsas.php"] [unique_id "acF1B8rwr-l5A-s9ryB2PwAAARA"]
[Tue Mar 24 01:14:47.549730 2026] [:error] [pid 56237:tid 56343] [client 172.213.9.13:50930] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xsas.php"] [unique_id "acF1BwymO0MnzQb90MMkwgAAAJY"]
[Tue Mar 24 01:14:48.045325 2026] [:error] [pid 56435:tid 56508] [client 172.213.9.13:62333] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xsas.php"] [unique_id "acF1CMrwr-l5A-s9ryB2RgAAAQg"]
[Tue Mar 24 01:14:48.555205 2026] [:error] [pid 56238:tid 56363] [client 172.213.9.13:62274] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xsas.php"] [unique_id "acF1CFSqceFAZRgPDq6brgAAAM8"]
[Tue Mar 24 01:14:49.120755 2026] [:error] [pid 56435:tid 56510] [client 172.213.9.13:44998] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acF1Ccrwr-l5A-s9ryB2TgAAAQo"]
[Tue Mar 24 01:14:49.663584 2026] [:error] [pid 56435:tid 56505] [client 172.213.9.13:47936] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acF1Ccrwr-l5A-s9ryB2VAAAAQY"]
[Tue Mar 24 01:14:50.180887 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:2541] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acF1Csrwr-l5A-s9ryB2WwAAAQ4"]
[Tue Mar 24 01:14:50.681428 2026] [:error] [pid 56435:tid 56513] [client 172.213.9.13:45004] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acF1Csrwr-l5A-s9ryB2YAAAAQw"]
[Tue Mar 24 01:14:51.195224 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:3036] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/okxh.php"] [unique_id "acF1C8rwr-l5A-s9ryB2ZAAAARE"]
[Tue Mar 24 01:14:51.717968 2026] [:error] [pid 56237:tid 56333] [client 172.213.9.13:3048] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/okxh.php"] [unique_id "acF1CwymO0MnzQb90MMkyAAAAIw"]
[Tue Mar 24 01:14:52.252276 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:62328] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/okxh.php"] [unique_id "acF1DFSqceFAZRgPDq6btgAAANQ"]
[Tue Mar 24 01:14:52.779967 2026] [:error] [pid 56238:tid 56365] [client 172.213.9.13:47966] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/okxh.php"] [unique_id "acF1DFSqceFAZRgPDq6buAAAANE"]
[Tue Mar 24 01:14:53.284130 2026] [:error] [pid 56238:tid 56364] [client 172.213.9.13:2404] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acF1DVSqceFAZRgPDq6bugAAANA"]
[Tue Mar 24 01:14:53.800655 2026] [:error] [pid 56238:tid 56363] [client 172.213.9.13:50900] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acF1DVSqceFAZRgPDq6bvQAAAM8"]
[Tue Mar 24 01:14:54.315785 2026] [:error] [pid 56236:tid 56299] [client 172.213.9.13:51641] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acF1DnapFgYp0uZ8twAhTgAAAEY"]
[Tue Mar 24 01:14:54.839927 2026] [:error] [pid 56435:tid 56510] [client 172.213.9.13:63987] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acF1Dsrwr-l5A-s9ryB2cwAAAQo"]
[Tue Mar 24 01:14:55.323500 2026] [:error] [pid 56237:tid 56323] [client 172.213.9.13:51607] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acF1DwymO0MnzQb90MMk0gAAAII"]
[Tue Mar 24 01:14:55.856276 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:48323] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acF1D8rwr-l5A-s9ryB2eAAAAQ4"]
[Tue Mar 24 01:14:56.365627 2026] [:error] [pid 56237:tid 56336] [client 172.213.9.13:48295] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acF1EAymO0MnzQb90MMk1wAAAI8"]
[Tue Mar 24 01:14:56.883165 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:48257] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acF1EFSqceFAZRgPDq6bxQAAANQ"]
[Tue Mar 24 01:14:57.390074 2026] [:error] [pid 56435:tid 56500] [client 172.213.9.13:45013] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acF1Ecrwr-l5A-s9ryB2fgAAAQE"]
[Tue Mar 24 01:14:57.880110 2026] [:error] [pid 56236:tid 56302] [client 172.213.9.13:44448] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acF1EXapFgYp0uZ8twAhUAAAAEk"]
[Tue Mar 24 01:14:58.391865 2026] [:error] [pid 56238:tid 56367] [client 172.213.9.13:44455] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acF1ElSqceFAZRgPDq6bzAAAANM"]
[Tue Mar 24 01:14:58.871573 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:51631] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acF1Esrwr-l5A-s9ryB2gQAAAQ8"]
[Tue Mar 24 01:14:59.412064 2026] [:error] [pid 56238:tid 56350] [client 172.213.9.13:42687] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acF1E1SqceFAZRgPDq6b0AAAAMI"]
[Tue Mar 24 01:14:59.915583 2026] [:error] [pid 56435:tid 56514] [client 172.213.9.13:44473] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acF1E8rwr-l5A-s9ryB2hgAAAQ0"]
[Tue Mar 24 01:15:00.408799 2026] [:error] [pid 56435:tid 56501] [client 172.213.9.13:48372] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acF1FMrwr-l5A-s9ryB2iQAAAQI"]
[Tue Mar 24 01:15:00.901722 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:2880] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acF1FMrwr-l5A-s9ryB2jgAAARA"]
[Tue Mar 24 01:15:01.427658 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:48338] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "acF1Fcrwr-l5A-s9ryB2kgAAARc"]
[Tue Mar 24 01:15:01.927992 2026] [:error] [pid 56238:tid 56356] [client 172.213.9.13:47539] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "acF1FVSqceFAZRgPDq6b2QAAAMg"]
[Tue Mar 24 01:15:02.447297 2026] [:error] [pid 56238:tid 56369] [client 172.213.9.13:2384] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "acF1FlSqceFAZRgPDq6b3AAAANU"]
[Tue Mar 24 01:15:02.926970 2026] [:error] [pid 56236:tid 56311] [client 172.213.9.13:45014] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hehe.php"] [unique_id "acF1FnapFgYp0uZ8twAhWQAAAFI"]
[Tue Mar 24 01:15:03.426482 2026] [:error] [pid 56236:tid 56315] [client 172.213.9.13:51612] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/varb.php"] [unique_id "acF1F3apFgYp0uZ8twAhWwAAAFY"]
[Tue Mar 24 01:15:03.907033 2026] [:error] [pid 56435:tid 56500] [client 172.213.9.13:62279] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/varb.php"] [unique_id "acF1F8rwr-l5A-s9ryB2nQAAAQE"]
[Tue Mar 24 01:15:04.405950 2026] [:error] [pid 56238:tid 56359] [client 172.213.9.13:2928] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/varb.php"] [unique_id "acF1GFSqceFAZRgPDq6b4QAAAMs"]
[Tue Mar 24 01:15:04.919666 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:47950] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/varb.php"] [unique_id "acF1GMrwr-l5A-s9ryB2pQAAARc"]
[Tue Mar 24 01:15:05.399410 2026] [:error] [pid 56237:tid 56333] [client 172.213.9.13:50887] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm15.php"] [unique_id "acF1GQymO0MnzQb90MMk5QAAAIw"]
[Tue Mar 24 01:15:05.905585 2026] [:error] [pid 56237:tid 56325] [client 172.213.9.13:48379] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm15.php"] [unique_id "acF1GQymO0MnzQb90MMk6gAAAIQ"]
[Tue Mar 24 01:15:06.420452 2026] [:error] [pid 56435:tid 56501] [client 172.213.9.13:3057] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm15.php"] [unique_id "acF1Gsrwr-l5A-s9ryB2qQAAAQI"]
[Tue Mar 24 01:15:06.913634 2026] [:error] [pid 56435:tid 56513] [client 172.213.9.13:45040] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm15.php"] [unique_id "acF1Gsrwr-l5A-s9ryB2qwAAAQw"]
[Tue Mar 24 01:15:07.434400 2026] [:error] [pid 56237:tid 56327] [client 172.213.9.13:2885] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clss.php"] [unique_id "acF1GwymO0MnzQb90MMk9gAAAIY"]
[Tue Mar 24 01:15:07.947337 2026] [:error] [pid 56237:tid 56330] [client 172.213.9.13:44475] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clss.php"] [unique_id "acF1GwymO0MnzQb90MMk-AAAAIk"]
[Tue Mar 24 01:15:23.265366 2026] [:error] [pid 56237:tid 56334] [client 172.213.9.13:51599] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wta.php"] [unique_id "acF1KwymO0MnzQb90MMlNQAAAI0"]
[Tue Mar 24 01:15:23.753510 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:50894] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wta.php"] [unique_id "acF1K1SqceFAZRgPDq6cEgAAANQ"]
[Tue Mar 24 01:15:24.256671 2026] [:error] [pid 56435:tid 56521] [client 172.213.9.13:2958] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wta.php"] [unique_id "acF1LMrwr-l5A-s9ryB28AAAARQ"]
[Tue Mar 24 01:15:24.773021 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:62306] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wta.php"] [unique_id "acF1LMrwr-l5A-s9ryB29AAAARA"]
[Tue Mar 24 01:15:25.283996 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:44461] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/privacy.php"] [unique_id "acF1Lcrwr-l5A-s9ryB2-QAAAQ8"]
[Tue Mar 24 01:15:25.755882 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:63938] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/privacy.php"] [unique_id "acF1Lcrwr-l5A-s9ryB3AQAAAQ4"]
[Tue Mar 24 01:15:26.234481 2026] [:error] [pid 56435:tid 56520] [client 172.213.9.13:2433] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/privacy.php"] [unique_id "acF1Lsrwr-l5A-s9ryB3BQAAARM"]
[Tue Mar 24 01:15:26.735275 2026] [:error] [pid 56238:tid 56364] [client 172.213.9.13:46950] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/privacy.php"] [unique_id "acF1LlSqceFAZRgPDq6cHwAAANA"]
[Tue Mar 24 01:15:27.253772 2026] [:error] [pid 56237:tid 56337] [client 172.213.9.13:47959] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws77.php"] [unique_id "acF1LwymO0MnzQb90MMlPwAAAJA"]
[Tue Mar 24 01:15:27.742464 2026] [:error] [pid 56238:tid 56371] [client 172.213.9.13:63973] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws77.php"] [unique_id "acF1L1SqceFAZRgPDq6cJQAAANc"]
[Tue Mar 24 01:15:28.247754 2026] [:error] [pid 56238:tid 56356] [client 172.213.9.13:44466] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws77.php"] [unique_id "acF1MFSqceFAZRgPDq6cKAAAAMg"]
[Tue Mar 24 01:15:28.731903 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:2963] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws77.php"] [unique_id "acF1MMrwr-l5A-s9ryB3DQAAARc"]
[Tue Mar 24 01:15:29.206972 2026] [:error] [pid 56237:tid 56344] [client 172.213.9.13:45016] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc13.php"] [unique_id "acF1MQymO0MnzQb90MMlRQAAAJc"]
[Tue Mar 24 01:15:29.690372 2026] [:error] [pid 56238:tid 56367] [client 172.213.9.13:2585] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc13.php"] [unique_id "acF1MVSqceFAZRgPDq6cMQAAANM"]
[Tue Mar 24 01:15:30.177503 2026] [:error] [pid 56237:tid 56338] [client 172.213.9.13:2591] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc13.php"] [unique_id "acF1MgymO0MnzQb90MMlSAAAAJE"]
[Tue Mar 24 01:15:30.658683 2026] [:error] [pid 56237:tid 56328] [client 172.213.9.13:3013] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc13.php"] [unique_id "acF1MgymO0MnzQb90MMlSwAAAIc"]
[Tue Mar 24 01:15:31.162045 2026] [:error] [pid 56435:tid 56524] [client 172.213.9.13:2573] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xper1.php"] [unique_id "acF1M8rwr-l5A-s9ryB3FwAAARc"]
[Tue Mar 24 01:15:31.638473 2026] [:error] [pid 56238:tid 56348] [client 172.213.9.13:63950] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xper1.php"] [unique_id "acF1M1SqceFAZRgPDq6cOwAAAMA"]
[Tue Mar 24 01:15:32.124117 2026] [:error] [pid 56238:tid 56367] [client 172.213.9.13:3019] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xper1.php"] [unique_id "acF1NFSqceFAZRgPDq6cPgAAANM"]
[Tue Mar 24 01:15:32.605100 2026] [:error] [pid 56435:tid 56503] [client 172.213.9.13:63945] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xper1.php"] [unique_id "acF1NMrwr-l5A-s9ryB3IwAAAQQ"]
[Tue Mar 24 01:15:33.086092 2026] [:error] [pid 56238:tid 56364] [client 172.213.9.13:50898] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelio1.php"] [unique_id "acF1NVSqceFAZRgPDq6cQwAAANA"]
[Tue Mar 24 01:15:33.577099 2026] [:error] [pid 56238:tid 56352] [client 172.213.9.13:50897] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelio1.php"] [unique_id "acF1NVSqceFAZRgPDq6cRwAAAMQ"]
[Tue Mar 24 01:15:34.055336 2026] [:error] [pid 56237:tid 56344] [client 172.213.9.13:63969] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelio1.php"] [unique_id "acF1NgymO0MnzQb90MMlWAAAAJc"]
[Tue Mar 24 01:15:34.556603 2026] [:error] [pid 56435:tid 56520] [client 172.213.9.13:62319] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelio1.php"] [unique_id "acF1Nsrwr-l5A-s9ryB3KAAAARM"]
[Tue Mar 24 01:15:35.039906 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:47943] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/save.php"] [unique_id "acF1N8rwr-l5A-s9ryB3LAAAARY"]
[Tue Mar 24 01:15:35.526129 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:51631] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/save.php"] [unique_id "acF1N8rwr-l5A-s9ryB3LwAAARE"]
[Tue Mar 24 01:15:36.010521 2026] [:error] [pid 56238:tid 56359] [client 172.213.9.13:44429] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/save.php"] [unique_id "acF1OFSqceFAZRgPDq6cVAAAAMs"]
[Tue Mar 24 01:15:36.484174 2026] [:error] [pid 56237:tid 56335] [client 172.213.9.13:51638] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/save.php"] [unique_id "acF1OAymO0MnzQb90MMlXQAAAI4"]
[Tue Mar 24 01:15:36.973273 2026] [:error] [pid 56238:tid 56366] [client 172.213.9.13:3017] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acF1OFSqceFAZRgPDq6cWgAAANI"]
[Tue Mar 24 01:15:37.485879 2026] [:error] [pid 56236:tid 56294] [client 172.213.9.13:45032] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acF1OXapFgYp0uZ8twAhpQAAAEE"]
[Tue Mar 24 01:15:37.975278 2026] [:error] [pid 56236:tid 56300] [client 172.213.9.13:2561] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acF1OXapFgYp0uZ8twAhqAAAAEc"]
[Tue Mar 24 01:15:38.441532 2026] [:error] [pid 56435:tid 56521] [client 172.213.9.13:63962] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acF1Osrwr-l5A-s9ryB3NwAAARQ"]
[Tue Mar 24 01:15:38.921791 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:62316] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roter.php"] [unique_id "acF1Osrwr-l5A-s9ryB3PAAAARY"]
[Tue Mar 24 01:15:39.444376 2026] [:error] [pid 56435:tid 56508] [client 172.213.9.13:62320] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roter.php"] [unique_id "acF1O8rwr-l5A-s9ryB3QQAAAQg"]
[Tue Mar 24 01:15:39.913433 2026] [:error] [pid 56238:tid 56371] [client 172.213.9.13:47998] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roter.php"] [unique_id "acF1O1SqceFAZRgPDq6cYAAAANc"]
[Tue Mar 24 01:15:40.454956 2026] [:error] [pid 56237:tid 56323] [client 172.213.9.13:62299] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roter.php"] [unique_id "acF1PAymO0MnzQb90MMlbQAAAII"]
[Tue Mar 24 01:15:40.956496 2026] [:error] [pid 56237:tid 56336] [client 172.213.9.13:62318] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shellerr.php"] [unique_id "acF1PAymO0MnzQb90MMldAAAAI8"]
[Tue Mar 24 01:15:41.456978 2026] [:error] [pid 56237:tid 56328] [client 172.213.9.13:43782] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shellerr.php"] [unique_id "acF1PQymO0MnzQb90MMleQAAAIc"]
[Tue Mar 24 01:15:41.937380 2026] [:error] [pid 56435:tid 56517] [client 172.213.9.13:3049] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shellerr.php"] [unique_id "acF1Pcrwr-l5A-s9ryB3SgAAARA"]
[Tue Mar 24 01:15:42.444694 2026] [:error] [pid 56236:tid 56314] [client 172.213.9.13:62315] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shellerr.php"] [unique_id "acF1PnapFgYp0uZ8twAhwAAAAFU"]
[Tue Mar 24 01:15:42.913424 2026] [:error] [pid 56236:tid 56309] [client 172.213.9.13:50885] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aee.php"] [unique_id "acF1PnapFgYp0uZ8twAhwwAAAFA"]
[Tue Mar 24 01:15:43.457703 2026] [:error] [pid 56237:tid 56340] [client 172.213.9.13:2952] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aee.php"] [unique_id "acF1PwymO0MnzQb90MMlfQAAAJM"]
[Tue Mar 24 01:15:43.957279 2026] [:error] [pid 56236:tid 56295] [client 172.213.9.13:3006] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aee.php"] [unique_id "acF1P3apFgYp0uZ8twAhxQAAAEI"]
[Tue Mar 24 01:15:44.440210 2026] [:error] [pid 56237:tid 56327] [client 172.213.9.13:62322] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aee.php"] [unique_id "acF1QAymO0MnzQb90MMlggAAAIY"]
[Tue Mar 24 01:15:44.908286 2026] [:error] [pid 56237:tid 56334] [client 172.213.9.13:63937] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sweg.php"] [unique_id "acF1QAymO0MnzQb90MMlhAAAAI0"]
[Tue Mar 24 01:15:45.421918 2026] [:error] [pid 56237:tid 56328] [client 172.213.9.13:3021] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sweg.php"] [unique_id "acF1QQymO0MnzQb90MMliQAAAIc"]
[Tue Mar 24 01:15:45.949761 2026] [:error] [pid 56238:tid 56369] [client 172.213.9.13:48331] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sweg.php"] [unique_id "acF1QVSqceFAZRgPDq6ccAAAANU"]
[Tue Mar 24 01:15:46.447455 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:44420] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sweg.php"] [unique_id "acF1Qsrwr-l5A-s9ryB3WQAAAQ4"]
[Tue Mar 24 01:15:46.917727 2026] [:error] [pid 56237:tid 56335] [client 172.213.9.13:2581] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phina.php"] [unique_id "acF1QgymO0MnzQb90MMljQAAAI4"]
[Tue Mar 24 01:15:47.499844 2026] [:error] [pid 56435:tid 56525] [client 172.213.9.13:45055] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phina.php"] [unique_id "acF1Q8rwr-l5A-s9ryB3YAAAARg"]
[Tue Mar 24 01:15:48.020074 2026] [:error] [pid 56435:tid 56513] [client 172.213.9.13:44456] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phina.php"] [unique_id "acF1RMrwr-l5A-s9ryB3aAAAAQw"]
[Tue Mar 24 01:15:48.570495 2026] [:error] [pid 56435:tid 56523] [client 172.213.9.13:2583] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phina.php"] [unique_id "acF1RMrwr-l5A-s9ryB3bgAAARY"]
[Tue Mar 24 01:15:49.090818 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:2941] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an7.php"] [unique_id "acF1Rcrwr-l5A-s9ryB3dAAAAQ8"]
[Tue Mar 24 01:15:49.692915 2026] [:error] [pid 56238:tid 56350] [client 172.213.9.13:51660] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an7.php"] [unique_id "acF1RVSqceFAZRgPDq6cdgAAAMI"]
[Tue Mar 24 01:15:50.279314 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:44422] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an7.php"] [unique_id "acF1Rsrwr-l5A-s9ryB3fAAAARU"]
[Tue Mar 24 01:15:50.888315 2026] [:error] [pid 56238:tid 56370] [client 172.213.9.13:2609] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an7.php"] [unique_id "acF1RlSqceFAZRgPDq6ceQAAANY"]
[Tue Mar 24 01:15:51.424924 2026] [:error] [pid 56435:tid 56499] [client 172.213.9.13:44425] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rovoj.php"] [unique_id "acF1R8rwr-l5A-s9ryB3hAAAAQA"]
[Tue Mar 24 01:15:51.915832 2026] [:error] [pid 56435:tid 56500] [client 172.213.9.13:2564] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rovoj.php"] [unique_id "acF1R8rwr-l5A-s9ryB3igAAAQE"]
[Tue Mar 24 01:15:52.484494 2026] [:error] [pid 56435:tid 56507] [client 172.213.9.13:48281] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rovoj.php"] [unique_id "acF1SMrwr-l5A-s9ryB3kAAAAQc"]
[Tue Mar 24 01:15:53.042002 2026] [:error] [pid 56435:tid 56514] [client 172.213.9.13:63977] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rovoj.php"] [unique_id "acF1Scrwr-l5A-s9ryB3lAAAAQ0"]
[Tue Mar 24 01:15:53.548873 2026] [:error] [pid 56435:tid 56519] [client 172.213.9.13:2480] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awh.php"] [unique_id "acF1Scrwr-l5A-s9ryB3mQAAARI"]
[Tue Mar 24 01:15:54.158831 2026] [:error] [pid 56236:tid 56306] [client 172.213.9.13:2996] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awh.php"] [unique_id "acF1SnapFgYp0uZ8twAh2QAAAE0"]
[Tue Mar 24 01:15:54.738492 2026] [:error] [pid 56435:tid 56514] [client 172.213.9.13:51614] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awh.php"] [unique_id "acF1Ssrwr-l5A-s9ryB3ngAAAQ0"]
[Tue Mar 24 01:15:55.307756 2026] [:error] [pid 56435:tid 56504] [client 172.213.9.13:63943] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awh.php"] [unique_id "acF1S8rwr-l5A-s9ryB3pwAAAQU"]
[Tue Mar 24 01:15:55.838646 2026] [:error] [pid 56435:tid 56516] [client 172.213.9.13:51682] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phpmini.php"] [unique_id "acF1S8rwr-l5A-s9ryB3rAAAAQ8"]
[Tue Mar 24 01:15:56.406911 2026] [:error] [pid 56237:tid 56321] [client 172.213.9.13:46915] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phpmini.php"] [unique_id "acF1TAymO0MnzQb90MMlmgAAAIA"]
[Tue Mar 24 01:15:57.001892 2026] [:error] [pid 56435:tid 56515] [client 172.213.9.13:48316] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phpmini.php"] [unique_id "acF1Tcrwr-l5A-s9ryB3vwAAAQ4"]
[Tue Mar 24 01:15:57.600940 2026] [:error] [pid 56238:tid 56349] [client 172.213.9.13:2424] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/phpmini.php"] [unique_id "acF1TVSqceFAZRgPDq6ciAAAAME"]
[Tue Mar 24 01:15:58.146676 2026] [:error] [pid 56435:tid 56522] [client 172.213.9.13:3047] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/caiij.php"] [unique_id "acF1Tsrwr-l5A-s9ryB3xAAAARU"]
[Tue Mar 24 01:15:58.656771 2026] [:error] [pid 56236:tid 56301] [client 172.213.9.13:2599] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/caiij.php"] [unique_id "acF1TnapFgYp0uZ8twAh3wAAAEg"]
[Tue Mar 24 01:15:59.221823 2026] [:error] [pid 56435:tid 56521] [client 172.213.9.13:2574] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/caiij.php"] [unique_id "acF1T8rwr-l5A-s9ryB3ygAAARQ"]
[Tue Mar 24 01:15:59.775233 2026] [:error] [pid 56238:tid 56369] [client 172.213.9.13:47942] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/caiij.php"] [unique_id "acF1T1SqceFAZRgPDq6clgAAANU"]
[Tue Mar 24 01:16:00.293842 2026] [:error] [pid 56236:tid 56302] [client 172.213.9.13:2444] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xex.php"] [unique_id "acF1UHapFgYp0uZ8twAh4wAAAEk"]
[Tue Mar 24 01:16:00.900528 2026] [:error] [pid 56238:tid 56354] [client 172.213.9.13:47532] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xex.php"] [unique_id "acF1UFSqceFAZRgPDq6cnQAAAMY"]
[Tue Mar 24 01:16:01.435900 2026] [:error] [pid 56238:tid 56364] [client 172.213.9.13:45028] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xex.php"] [unique_id "acF1UVSqceFAZRgPDq6cqAAAANA"]
[Tue Mar 24 01:16:01.987869 2026] [:error] [pid 56238:tid 56350] [client 172.213.9.13:48342] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xex.php"] [unique_id "acF1UVSqceFAZRgPDq6crwAAAMI"]
[Tue Mar 24 01:16:02.505462 2026] [:error] [pid 56435:tid 56518] [client 172.213.9.13:47965] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gk.php"] [unique_id "acF1Usrwr-l5A-s9ryB33wAAARE"]
[Tue Mar 24 01:16:03.008153 2026] [:error] [pid 56238:tid 56351] [client 172.213.9.13:2575] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gk.php"] [unique_id "acF1U1SqceFAZRgPDq6cswAAAMM"]
[Tue Mar 24 01:16:03.543729 2026] [:error] [pid 56435:tid 56519] [client 172.213.9.13:2490] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gk.php"] [unique_id "acF1U8rwr-l5A-s9ryB36gAAARI"]
[Tue Mar 24 01:16:04.056148 2026] [:error] [pid 56236:tid 56299] [client 172.213.9.13:47979] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gk.php"] [unique_id "acF1VHapFgYp0uZ8twAh7AAAAEY"]
[Tue Mar 24 01:16:04.563675 2026] [:error] [pid 56435:tid 56499] [client 172.213.9.13:48271] [client 172.213.9.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/app.php"] [unique_id "acF1VMrwr-l5A-s9ryB38QAAAQA"]
[Tue Mar 24 01:16:05.052927 2026] [:error] [pid 56238:tid 56353] [client 172.213.9.13:44443] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/max.php"] [unique_id "acF1VVSqceFAZRgPDq6cxgAAAMU"]
[Tue Mar 24 01:16:05.550582 2026] [:error] [pid 56238:tid 56368] [client 172.213.9.13:2426] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/max.php"] [unique_id "acF1VVSqceFAZRgPDq6cygAAANQ"]
[Tue Mar 24 01:16:06.090998 2026] [:error] [pid 56238:tid 56371] [client 172.213.9.13:51625] [client 172.213.9.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/maint/max.php"] [unique_id "acF1VlSqceFAZRgPDq6czgAAANc"]
[Tue Mar 24 01:45:56.056608 2026] [:error] [pid 56435:tid 56518] [client 82.198.236.94:39162] [client 82.198.236.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "acF8VMrwr-l5A-s9ryCO6AAAARE"]
[Tue Mar 24 03:31:23.458785 2026] [:error] [pid 64589:tid 64642] [client 43.153.102.138:51900] [client 43.153.102.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acGVC9H18EfAHpJCXqz9ggAAAEo"]
[Tue Mar 24 03:39:31.219547 2026] [:error] [pid 37681:tid 37689] [client 182.42.110.255:36354] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acGW81ZyjMpz5oys0C-vgQAAAMY"]
[Tue Mar 24 06:19:34.927067 2026] [:error] [pid 38767:tid 38783] [client 43.131.23.154:37992] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acG8dvwkUqN4GJAI5oWJAAAAAQ0"]
[Tue Mar 24 07:58:54.414490 2026] [:error] [pid 3031:tid 3082] [client 216.81.245.218:47880] [client 216.81.245.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "acHTvqJBKytnG47nuib4SQAAAEY"]
[Tue Mar 24 09:02:44.788120 2026] [:error] [pid 38767:tid 38792] [client 185.223.152.139:40525] [client 185.223.152.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.139, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acHitPwkUqN4GJAI5oXAGAAAARY"]
[Tue Mar 24 10:30:44.727410 2026] [:error] [pid 48214:tid 48269] [client 182.42.111.156:48642] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acH3VLeshLWZ3uUDHKkKMAAAAdE"]
[Tue Mar 24 12:12:27.195388 2026] [:error] [pid 48214:tid 48272] [client 124.156.157.91:45680] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acIPK7eshLWZ3uUDHKkd1AAAAdQ"]
[Tue Mar 24 17:59:49.993803 2026] [:error] [pid 48219:tid 48285] [client 103.117.162.224:54482] [client 103.117.162.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.162.224, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acJglShf3b4R_lAIyv9dLwAAAgQ"]
[Tue Mar 24 20:49:25.094676 2026] [:error] [pid 64198:tid 64216] [client 170.106.160.90:40360] [client 170.106.160.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acKIVXVzJqf6OS_oSZ3ArwAAAVA"]
[Tue Mar 24 23:08:19.319072 2026] [:error] [pid 48214:tid 48261] [client 43.153.104.196:43286] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acKo47eshLWZ3uUDHKmF3gAAAck"]
[Tue Mar 24 23:10:43.507384 2026] [:error] [pid 48219:tid 48295] [client 103.152.100.86:5597] [client 103.152.100.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.152.100.86, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acKpcyhf3b4R_lAIyv-hgwAAAg4"]
[Wed Mar 25 00:31:06.169063 2026] [:error] [pid 57711:tid 58070] [client 223.178.84.115:19395] [client 223.178.84.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.84.115, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acK8SqLdPFdeRRktTdNJ8AAAAJA"]
[Wed Mar 25 00:38:24.330059 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:61558] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx81.php"] [unique_id "acK-AKS8TU_xcQFvlnb1zgAAAAI"]
[Wed Mar 25 00:38:34.610741 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60230] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx81.php"] [unique_id "acK-Cg0pGUh6bwD3ouJ9TQAAAME"]
[Wed Mar 25 00:38:35.172269 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:61588] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx81.php"] [unique_id "acK-C6S8TU_xcQFvlnb12gAAABQ"]
[Wed Mar 25 00:38:35.656901 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60321] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx81.php"] [unique_id "acK-C6S8TU_xcQFvlnb13AAAAAM"]
[Wed Mar 25 00:38:36.202745 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:61617] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xr.php"] [unique_id "acK-DKLdPFdeRRktTdNNpgAAAJQ"]
[Wed Mar 25 00:38:36.708105 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:60266] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xr.php"] [unique_id "acK-DKLdPFdeRRktTdNNqAAAAJE"]
[Wed Mar 25 00:38:38.052485 2026] [:error] [pid 57703:tid 58028] [client 158.158.111.117:60912] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xr.php"] [unique_id "acK-DvIVQxDtjkklWGZOfwAAAEk"]
[Wed Mar 25 00:38:38.662435 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:61562] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xr.php"] [unique_id "acK-Dg0pGUh6bwD3ouJ9YQAAANY"]
[Wed Mar 25 00:38:39.164577 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:61542] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "acK-D6S8TU_xcQFvlnb14gAAAAk"]
[Wed Mar 25 00:38:39.670505 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:61528] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "acK-D6LdPFdeRRktTdNNqgAAAJg"]
[Wed Mar 25 00:38:40.246746 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60261] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "acK-EA0pGUh6bwD3ouJ9ZQAAAMg"]
[Wed Mar 25 00:38:40.741511 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60236] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "acK-EA0pGUh6bwD3ouJ9aQAAAME"]
[Wed Mar 25 00:38:41.261576 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60279] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zrerbwfu.php"] [unique_id "acK-EQ0pGUh6bwD3ouJ9bQAAAMA"]
[Wed Mar 25 00:38:41.802580 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59746] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zrerbwfu.php"] [unique_id "acK-EQ0pGUh6bwD3ouJ9bwAAAMw"]
[Wed Mar 25 00:38:42.332820 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:60982] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zrerbwfu.php"] [unique_id "acK-EqLdPFdeRRktTdNNqwAAAJM"]
[Wed Mar 25 00:38:42.836447 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61566] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zrerbwfu.php"] [unique_id "acK-Eg0pGUh6bwD3ouJ9cQAAANU"]
[Wed Mar 25 00:38:43.463575 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:60331] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/black.php"] [unique_id "acK-Ew0pGUh6bwD3ouJ9cgAAAMs"]
[Wed Mar 25 00:38:44.015774 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:60911] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/black.php"] [unique_id "acK-FKS8TU_xcQFvlnb16AAAABQ"]
[Wed Mar 25 00:38:44.526401 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60305] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/black.php"] [unique_id "acK-FA0pGUh6bwD3ouJ9eAAAANI"]
[Wed Mar 25 00:38:45.024359 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:61619] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/black.php"] [unique_id "acK-FQ0pGUh6bwD3ouJ9egAAANY"]
[Wed Mar 25 00:38:45.641816 2026] [:error] [pid 57711:tid 58060] [client 158.158.111.117:60247] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nz.php"] [unique_id "acK-FaLdPFdeRRktTdNNrQAAAIg"]
[Wed Mar 25 00:38:46.130998 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:60966] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nz.php"] [unique_id "acK-FqLdPFdeRRktTdNNrgAAAIE"]
[Wed Mar 25 00:38:46.853835 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:60301] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nz.php"] [unique_id "acK-FqLdPFdeRRktTdNNrwAAAIk"]
[Wed Mar 25 00:38:47.369412 2026] [:error] [pid 57702:tid 57915] [client 158.158.111.117:59655] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nz.php"] [unique_id "acK-F6S8TU_xcQFvlnb18AAAAAw"]
[Wed Mar 25 00:38:47.875484 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:59103] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vv.php"] [unique_id "acK-Fw0pGUh6bwD3ouJ9gQAAANA"]
[Wed Mar 25 00:38:48.407456 2026] [:error] [pid 57702:tid 57916] [client 158.158.111.117:61587] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vv.php"] [unique_id "acK-GKS8TU_xcQFvlnb18wAAAA0"]
[Wed Mar 25 00:38:49.135272 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:61538] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vv.php"] [unique_id "acK-GaS8TU_xcQFvlnb1-AAAAAg"]
[Wed Mar 25 00:38:50.111994 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:60273] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vv.php"] [unique_id "acK-GvIVQxDtjkklWGZOhwAAAFE"]
[Wed Mar 25 00:38:50.720105 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:60286] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acK-GqLdPFdeRRktTdNNsQAAAIs"]
[Wed Mar 25 00:38:51.201771 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:59758] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acK-G6LdPFdeRRktTdNNsgAAAIo"]
[Wed Mar 25 00:38:51.752389 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:60303] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acK-G_IVQxDtjkklWGZOjAAAAEw"]
[Wed Mar 25 00:38:52.260355 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60325] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acK-HKS8TU_xcQFvlnb1_wAAAAM"]
[Wed Mar 25 00:38:52.929180 2026] [:error] [pid 57711:tid 58054] [client 158.158.111.117:60871] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-scxy.php"] [unique_id "acK-HKLdPFdeRRktTdNNtAAAAIM"]
[Wed Mar 25 00:38:53.533939 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59652] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-scxy.php"] [unique_id "acK-HQ0pGUh6bwD3ouJ9hgAAANc"]
[Wed Mar 25 00:38:54.103853 2026] [:error] [pid 57703:tid 58033] [client 158.158.111.117:61604] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-scxy.php"] [unique_id "acK-HvIVQxDtjkklWGZOkwAAAE4"]
[Wed Mar 25 00:38:54.607753 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:61603] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-scxy.php"] [unique_id "acK-HqS8TU_xcQFvlnb2AgAAABE"]
[Wed Mar 25 00:38:55.287531 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60291] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccou1.php"] [unique_id "acK-Hw0pGUh6bwD3ouJ9igAAAM8"]
[Wed Mar 25 00:38:55.805779 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60244] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccou1.php"] [unique_id "acK-Hw0pGUh6bwD3ouJ9jgAAAMY"]
[Wed Mar 25 00:38:56.346591 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60913] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccou1.php"] [unique_id "acK-IA0pGUh6bwD3ouJ9kwAAAMc"]
[Wed Mar 25 00:38:56.983705 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:61510] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccou1.php"] [unique_id "acK-IKS8TU_xcQFvlnb2BQAAAA8"]
[Wed Mar 25 00:38:57.552979 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60988] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-the1.php"] [unique_id "acK-IQ0pGUh6bwD3ouJ9lQAAAMA"]
[Wed Mar 25 00:38:58.082774 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60266] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-the1.php"] [unique_id "acK-Ig0pGUh6bwD3ouJ9lgAAAM8"]
[Wed Mar 25 00:38:58.649277 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:60933] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-the1.php"] [unique_id "acK-Ig0pGUh6bwD3ouJ9mAAAAMs"]
[Wed Mar 25 00:38:59.213346 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:60903] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-the1.php"] [unique_id "acK-Iw0pGUh6bwD3ouJ9mgAAANg"]
[Wed Mar 25 00:38:59.698858 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:61594] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reyna.php"] [unique_id "acK-Iw0pGUh6bwD3ouJ9nwAAAMM"]
[Wed Mar 25 00:39:00.202208 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:61513] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reyna.php"] [unique_id "acK-JKLdPFdeRRktTdNNvAAAAIk"]
[Wed Mar 25 00:39:00.758763 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59757] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reyna.php"] [unique_id "acK-JA0pGUh6bwD3ouJ9ogAAAMA"]
[Wed Mar 25 00:39:01.298370 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:60892] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reyna.php"] [unique_id "acK-JQ0pGUh6bwD3ouJ9pAAAAMU"]
[Wed Mar 25 00:39:01.837182 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:59728] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "acK-JaLdPFdeRRktTdNNvwAAAI4"]
[Wed Mar 25 00:39:02.395925 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60251] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cah.php"] [unique_id "acK-Jg0pGUh6bwD3ouJ9pgAAANA"]
[Wed Mar 25 00:39:02.920198 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:60950] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cah.php"] [unique_id "acK-JqLdPFdeRRktTdNNwAAAAIU"]
[Wed Mar 25 00:39:03.465249 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:59747] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cah.php"] [unique_id "acK-J6S8TU_xcQFvlnb2DAAAAAU"]
[Wed Mar 25 00:39:03.961378 2026] [:error] [pid 57703:tid 58035] [client 158.158.111.117:60253] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cah.php"] [unique_id "acK-J_IVQxDtjkklWGZOlwAAAFA"]
[Wed Mar 25 00:39:04.912210 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:60272] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acK-KPIVQxDtjkklWGZOmgAAAEg"]
[Wed Mar 25 00:39:05.418588 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:61585] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acK-KaLdPFdeRRktTdNNxQAAAJY"]
[Wed Mar 25 00:39:06.006451 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:60924] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acK-Kg0pGUh6bwD3ouJ9sgAAAMo"]
[Wed Mar 25 00:39:06.583344 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:60226] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acK-KqS8TU_xcQFvlnb2DwAAAAE"]
[Wed Mar 25 00:39:07.115665 2026] [:error] [pid 57702:tid 57913] [client 158.158.111.117:60289] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acK-K6S8TU_xcQFvlnb2EgAAAAo"]
[Wed Mar 25 00:39:07.769297 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:59721] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acK-K6S8TU_xcQFvlnb2FAAAAAc"]
[Wed Mar 25 00:39:08.399017 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:60931] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acK-LPIVQxDtjkklWGZOnQAAAEE"]
[Wed Mar 25 00:39:09.079685 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60908] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acK-LQ0pGUh6bwD3ouJ9vgAAAMY"]
[Wed Mar 25 00:39:09.625686 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:61576] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/muzu.php"] [unique_id "acK-LfIVQxDtjkklWGZOogAAAFI"]
[Wed Mar 25 00:39:10.149754 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59752] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/muzu.php"] [unique_id "acK-Lg0pGUh6bwD3ouJ9vwAAAMw"]
[Wed Mar 25 00:39:10.763746 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:59756] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/muzu.php"] [unique_id "acK-LvIVQxDtjkklWGZOpAAAAEM"]
[Wed Mar 25 00:39:11.495293 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59656] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/muzu.php"] [unique_id "acK-Lw0pGUh6bwD3ouJ9wwAAAMI"]
[Wed Mar 25 00:39:12.045957 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:59653] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "acK-MKLdPFdeRRktTdNN0AAAAIc"]
[Wed Mar 25 00:39:12.630405 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:60339] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "acK-MKS8TU_xcQFvlnb2GwAAAAQ"]
[Wed Mar 25 00:39:13.157166 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:59754] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "acK-MQ0pGUh6bwD3ouJ9xQAAANM"]
[Wed Mar 25 00:39:13.710003 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60268] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "acK-MQ0pGUh6bwD3ouJ9yAAAAME"]
[Wed Mar 25 00:39:14.273230 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:60920] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "acK-Mg0pGUh6bwD3ouJ9ywAAANU"]
[Wed Mar 25 00:39:14.822794 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60893] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "acK-Mg0pGUh6bwD3ouJ9zgAAAMA"]
[Wed Mar 25 00:39:15.357716 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:60232] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "acK-Mw0pGUh6bwD3ouJ90QAAANM"]
[Wed Mar 25 00:39:15.934003 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:59760] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpo.php"] [unique_id "acK-Mw0pGUh6bwD3ouJ91gAAAMQ"]
[Wed Mar 25 00:39:16.568076 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:61625] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aq.php"] [unique_id "acK-NA0pGUh6bwD3ouJ92QAAANY"]
[Wed Mar 25 00:39:17.179248 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:60986] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aq.php"] [unique_id "acK-NaLdPFdeRRktTdNN0wAAAIY"]
[Wed Mar 25 00:39:17.715087 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:61582] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aq.php"] [unique_id "acK-NQ0pGUh6bwD3ouJ93QAAANg"]
[Wed Mar 25 00:39:18.211914 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:60310] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aq.php"] [unique_id "acK-NqS8TU_xcQFvlnb2HwAAABA"]
[Wed Mar 25 00:39:18.745714 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:61515] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/011i.php"] [unique_id "acK-NvIVQxDtjkklWGZOqgAAAFI"]
[Wed Mar 25 00:39:19.296733 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:59690] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/011i.php"] [unique_id "acK-N6S8TU_xcQFvlnb2IAAAABI"]
[Wed Mar 25 00:39:19.779020 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:60989] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/011i.php"] [unique_id "acK-N6LdPFdeRRktTdNN1gAAAIQ"]
[Wed Mar 25 00:39:20.305686 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60865] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/011i.php"] [unique_id "acK-OKLdPFdeRRktTdNN2AAAAII"]
[Wed Mar 25 00:39:20.949871 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60934] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit-tags.php"] [unique_id "acK-OKS8TU_xcQFvlnb2JwAAABY"]
[Wed Mar 25 00:39:21.498953 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:60951] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit-tags.php"] [unique_id "acK-OfIVQxDtjkklWGZOsQAAAEM"]
[Wed Mar 25 00:39:22.132600 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60954] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit-tags.php"] [unique_id "acK-OqS8TU_xcQFvlnb2LgAAAAM"]
[Wed Mar 25 00:39:22.728118 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:61599] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit-tags.php"] [unique_id "acK-OqS8TU_xcQFvlnb2MQAAABM"]
[Wed Mar 25 00:39:38.487012 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:60336] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/about.php"] [unique_id "acK-SvIVQxDtjkklWGZO6AAAAEs"]
[Wed Mar 25 00:39:43.026437 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:60961] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acK-T6LdPFdeRRktTdNN8QAAAJI"]
[Wed Mar 25 00:39:43.520475 2026] [:error] [pid 57711:tid 58054] [client 158.158.111.117:60907] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acK-T6LdPFdeRRktTdNN8gAAAIM"]
[Wed Mar 25 00:39:44.073405 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:60883] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acK-UKLdPFdeRRktTdNN9AAAAI8"]
[Wed Mar 25 00:39:44.563759 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:60227] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acK-UKLdPFdeRRktTdNN9wAAAIE"]
[Wed Mar 25 00:39:45.095077 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:61620] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acK-UQ0pGUh6bwD3ouJ9_QAAAM8"]
[Wed Mar 25 00:39:45.582002 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:58187] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acK-UQ0pGUh6bwD3ouJ9_gAAAMQ"]
[Wed Mar 25 00:39:46.112202 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60285] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acK-Ug0pGUh6bwD3ouJ-AgAAAME"]
[Wed Mar 25 00:39:46.645952 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:59723] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acK-Ug0pGUh6bwD3ouJ-BgAAANU"]
[Wed Mar 25 00:39:47.170863 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:60292] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acK-U_IVQxDtjkklWGZO9wAAAEw"]
[Wed Mar 25 00:39:47.698049 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:60302] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acK-U6S8TU_xcQFvlnb2UAAAABc"]
[Wed Mar 25 00:39:48.239608 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:60267] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acK-VKS8TU_xcQFvlnb2UgAAABI"]
[Wed Mar 25 00:39:48.851474 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60343] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acK-VA0pGUh6bwD3ouJ-CAAAAMk"]
[Wed Mar 25 00:39:49.398900 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:60287] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/co.php"] [unique_id "acK-VQ0pGUh6bwD3ouJ-CQAAANM"]
[Wed Mar 25 00:39:49.937464 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:61511] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/co.php"] [unique_id "acK-VQ0pGUh6bwD3ouJ-DAAAANA"]
[Wed Mar 25 00:39:50.463278 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:61529] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/co.php"] [unique_id "acK-Vg0pGUh6bwD3ouJ-DgAAAMU"]
[Wed Mar 25 00:39:50.996570 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60906] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/co.php"] [unique_id "acK-Vg0pGUh6bwD3ouJ-EAAAANc"]
[Wed Mar 25 00:39:51.498318 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:59726] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "acK-V6S8TU_xcQFvlnb2WQAAABU"]
[Wed Mar 25 00:39:52.004101 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:57614] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "acK-WPIVQxDtjkklWGZO_AAAAFE"]
[Wed Mar 25 00:39:52.570538 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:61524] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "acK-WPIVQxDtjkklWGZO_wAAAFI"]
[Wed Mar 25 00:39:53.140613 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:60889] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/themes.php"] [unique_id "acK-WaS8TU_xcQFvlnb2WwAAAA4"]
[Wed Mar 25 00:39:53.986034 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60297] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acK-WQ0pGUh6bwD3ouJ-HAAAAME"]
[Wed Mar 25 00:39:54.650342 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:59130] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acK-WqLdPFdeRRktTdNN_QAAAIk"]
[Wed Mar 25 00:39:55.158716 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:61610] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acK-W_IVQxDtjkklWGZPCAAAAEo"]
[Wed Mar 25 00:39:55.651737 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61595] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acK-Ww0pGUh6bwD3ouJ-IwAAANU"]
[Wed Mar 25 00:39:56.220793 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:59734] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reze.php"] [unique_id "acK-XKS8TU_xcQFvlnb2XwAAAAI"]
[Wed Mar 25 00:39:56.918764 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59100] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reze.php"] [unique_id "acK-XA0pGUh6bwD3ouJ-JwAAANc"]
[Wed Mar 25 00:39:57.481217 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60347] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reze.php"] [unique_id "acK-XQ0pGUh6bwD3ouJ-LAAAAMA"]
[Wed Mar 25 00:39:57.966343 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60910] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/reze.php"] [unique_id "acK-XQ0pGUh6bwD3ouJ-LgAAAMc"]
[Wed Mar 25 00:39:58.524711 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:59057] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acK-XqS8TU_xcQFvlnb2YwAAAAk"]
[Wed Mar 25 00:39:59.088085 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60974] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acK-Xw0pGUh6bwD3ouJ-NwAAAMw"]
[Wed Mar 25 00:39:59.594570 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:60346] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acK-X6S8TU_xcQFvlnb2ZQAAAAg"]
[Wed Mar 25 00:40:00.187984 2026] [:error] [pid 57703:tid 58041] [client 158.158.111.117:61545] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acK-YPIVQxDtjkklWGZPFQAAAFY"]
[Wed Mar 25 00:40:00.683720 2026] [:error] [pid 57703:tid 58024] [client 158.158.111.117:60257] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x.php"] [unique_id "acK-YPIVQxDtjkklWGZPGAAAAEU"]
[Wed Mar 25 00:40:01.192884 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61552] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x.php"] [unique_id "acK-YQ0pGUh6bwD3ouJ-PQAAANU"]
[Wed Mar 25 00:40:01.745371 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60329] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x.php"] [unique_id "acK-YQ0pGUh6bwD3ouJ-QgAAAMw"]
[Wed Mar 25 00:40:02.236468 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:61504] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x.php"] [unique_id "acK-YqS8TU_xcQFvlnb2ZwAAAA4"]
[Wed Mar 25 00:40:02.805377 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:61578] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acK-YqS8TU_xcQFvlnb2aAAAABc"]
[Wed Mar 25 00:40:03.396408 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61507] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acK-Yw0pGUh6bwD3ouJ-SQAAANU"]
[Wed Mar 25 00:40:03.901493 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:60972] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acK-Y6S8TU_xcQFvlnb2bQAAAA8"]
[Wed Mar 25 00:40:04.487716 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60278] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acK-ZKS8TU_xcQFvlnb2bgAAAAc"]
[Wed Mar 25 00:40:05.021620 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:60915] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "acK-ZaS8TU_xcQFvlnb2cwAAABE"]
[Wed Mar 25 00:40:05.550179 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:60300] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "acK-ZaLdPFdeRRktTdNOBAAAAI0"]
[Wed Mar 25 00:40:06.076574 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:61516] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "acK-ZqLdPFdeRRktTdNOBQAAAIA"]
[Wed Mar 25 00:40:06.568146 2026] [:error] [pid 57711:tid 58075] [client 158.158.111.117:59114] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "acK-ZqLdPFdeRRktTdNOBwAAAJU"]
[Wed Mar 25 00:40:07.133827 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:60876] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past1.php"] [unique_id "acK-Z6LdPFdeRRktTdNOCwAAAIs"]
[Wed Mar 25 00:40:07.644363 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60896] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past1.php"] [unique_id "acK-Zw0pGUh6bwD3ouJ-UAAAAMc"]
[Wed Mar 25 00:40:08.194312 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:61629] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past1.php"] [unique_id "acK-aA0pGUh6bwD3ouJ-UgAAAME"]
[Wed Mar 25 00:40:08.753573 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:60271] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/past1.php"] [unique_id "acK-aKS8TU_xcQFvlnb2dgAAAAI"]
[Wed Mar 25 00:40:09.249142 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:60923] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xyz.php"] [unique_id "acK-aQ0pGUh6bwD3ouJ-WAAAAMI"]
[Wed Mar 25 00:40:09.804754 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:59767] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xyz.php"] [unique_id "acK-aaS8TU_xcQFvlnb2dwAAAAU"]
[Wed Mar 25 00:40:10.345049 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:61544] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xyz.php"] [unique_id "acK-ag0pGUh6bwD3ouJ-XgAAANA"]
[Wed Mar 25 00:40:10.927729 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:60919] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xyz.php"] [unique_id "acK-aqS8TU_xcQFvlnb2fQAAABA"]
[Wed Mar 25 00:40:11.489469 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:60312] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acK-a6S8TU_xcQFvlnb2gAAAAA4"]
[Wed Mar 25 00:40:12.154151 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:60309] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acK-bA0pGUh6bwD3ouJ-YwAAAMI"]
[Wed Mar 25 00:40:12.732882 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60270] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acK-bA0pGUh6bwD3ouJ-ZgAAANY"]
[Wed Mar 25 00:40:13.368133 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60970] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acK-bQ0pGUh6bwD3ouJ-ZwAAAMg"]
[Wed Mar 25 00:40:14.024773 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:59704] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bk.php"] [unique_id "acK-bg0pGUh6bwD3ouJ-agAAANg"]
[Wed Mar 25 00:40:14.836285 2026] [:error] [pid 57703:tid 58034] [client 158.158.111.117:60922] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bk.php"] [unique_id "acK-bvIVQxDtjkklWGZPHgAAAE8"]
[Wed Mar 25 00:40:15.797900 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:58146] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bk.php"] [unique_id "acK-b6LdPFdeRRktTdNODwAAAIQ"]
[Wed Mar 25 00:40:16.415098 2026] [:error] [pid 57711:tid 58075] [client 158.158.111.117:59654] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bk.php"] [unique_id "acK-cKLdPFdeRRktTdNOEQAAAJU"]
[Wed Mar 25 00:40:17.124414 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:58214] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vx.php"] [unique_id "acK-cfIVQxDtjkklWGZPHwAAAFU"]
[Wed Mar 25 00:40:18.026174 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60298] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vx.php"] [unique_id "acK-cqS8TU_xcQFvlnb2kwAAABY"]
[Wed Mar 25 00:40:19.455114 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:60334] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vx.php"] [unique_id "acK-c6S8TU_xcQFvlnb2mAAAABc"]
[Wed Mar 25 00:40:20.066496 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:60881] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vx.php"] [unique_id "acK-dKS8TU_xcQFvlnb2mQAAAAU"]
[Wed Mar 25 00:40:21.088413 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:58118] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx.php"] [unique_id "acK-daS8TU_xcQFvlnb2nwAAABA"]
[Wed Mar 25 00:40:21.921773 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:60870] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx.php"] [unique_id "acK-dQ0pGUh6bwD3ouJ-dQAAANQ"]
[Wed Mar 25 00:40:23.697594 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:61615] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx.php"] [unique_id "acK-dw0pGUh6bwD3ouJ-hAAAAMU"]
[Wed Mar 25 00:40:25.659868 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59086] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx.php"] [unique_id "acK-eQ0pGUh6bwD3ouJ-lAAAAMA"]
[Wed Mar 25 00:40:26.660788 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:58176] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/grsiuk.php"] [unique_id "acK-eg0pGUh6bwD3ouJ-lwAAAM0"]
[Wed Mar 25 00:40:27.486605 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60985] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/grsiuk.php"] [unique_id "acK-ew0pGUh6bwD3ouJ-mgAAAMM"]
[Wed Mar 25 00:40:28.783746 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59750] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/grsiuk.php"] [unique_id "acK-fKS8TU_xcQFvlnb2wwAAABg"]
[Wed Mar 25 00:40:29.619457 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:61547] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/grsiuk.php"] [unique_id "acK-fQ0pGUh6bwD3ouJ-oAAAAME"]
[Wed Mar 25 00:40:31.051688 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:59772] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byel.php"] [unique_id "acK-f6S8TU_xcQFvlnb2zgAAAAM"]
[Wed Mar 25 00:40:32.043825 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:60867] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byel.php"] [unique_id "acK-gKS8TU_xcQFvlnb20QAAAAE"]
[Wed Mar 25 00:40:32.815684 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:61577] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byel.php"] [unique_id "acK-gKLdPFdeRRktTdNOGAAAAIo"]
[Wed Mar 25 00:40:33.357519 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:61554] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byel.php"] [unique_id "acK-gaLdPFdeRRktTdNOGQAAAI8"]
[Wed Mar 25 00:40:33.969347 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:60943] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/layou.php"] [unique_id "acK-gaS8TU_xcQFvlnb22QAAAAU"]
[Wed Mar 25 00:40:34.620155 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:59023] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/layou.php"] [unique_id "acK-gqLdPFdeRRktTdNOGwAAAIw"]
[Wed Mar 25 00:40:35.297479 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:61570] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/layou.php"] [unique_id "acK-g6S8TU_xcQFvlnb23AAAAAg"]
[Wed Mar 25 00:40:35.786801 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:60968] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/layou.php"] [unique_id "acK-g6LdPFdeRRktTdNOHgAAAJc"]
[Wed Mar 25 00:40:36.362910 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60233] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lgsts.php"] [unique_id "acK-hA0pGUh6bwD3ouJ-rgAAAMc"]
[Wed Mar 25 00:40:37.015711 2026] [:error] [pid 57703:tid 58025] [client 158.158.111.117:60228] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lgsts.php"] [unique_id "acK-hfIVQxDtjkklWGZPJgAAAEY"]
[Wed Mar 25 00:40:37.595955 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:59650] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lgsts.php"] [unique_id "acK-hQ0pGUh6bwD3ouJ-swAAANM"]
[Wed Mar 25 00:40:38.187847 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:60238] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lgsts.php"] [unique_id "acK-hqLdPFdeRRktTdNOIAAAAJE"]
[Wed Mar 25 00:40:38.845194 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60289] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tourpa.php"] [unique_id "acK-hg0pGUh6bwD3ouJ-ugAAANc"]
[Wed Mar 25 00:40:39.402095 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:60269] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tourpa.php"] [unique_id "acK-h6LdPFdeRRktTdNOIQAAAJQ"]
[Wed Mar 25 00:40:40.054958 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:59771] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tourpa.php"] [unique_id "acK-iKS8TU_xcQFvlnb24QAAAAA"]
[Wed Mar 25 00:40:40.590566 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60984] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tourpa.php"] [unique_id "acK-iA0pGUh6bwD3ouJ-wgAAAM0"]
[Wed Mar 25 00:41:01.786804 2026] [:error] [pid 57703:tid 58035] [client 158.158.111.117:60245] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bfasb.php"] [unique_id "acK-nfIVQxDtjkklWGZPQQAAAFA"]
[Wed Mar 25 00:41:02.399183 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60320] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bfasb.php"] [unique_id "acK-ng0pGUh6bwD3ouJ_NgAAAMg"]
[Wed Mar 25 00:41:03.119168 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:61537] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bfasb.php"] [unique_id "acK-n6S8TU_xcQFvlnb3CwAAAAE"]
[Wed Mar 25 00:41:03.692735 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:58122] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bfasb.php"] [unique_id "acK-n6S8TU_xcQFvlnb3DQAAAAk"]
[Wed Mar 25 00:41:04.413529 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60295] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clcdu.php"] [unique_id "acK-oKS8TU_xcQFvlnb3DwAAAAM"]
[Wed Mar 25 00:41:05.161823 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:61616] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clcdu.php"] [unique_id "acK-oaLdPFdeRRktTdNOKwAAAJE"]
[Wed Mar 25 00:41:05.669359 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:59732] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clcdu.php"] [unique_id "acK-oaS8TU_xcQFvlnb3EgAAAAQ"]
[Wed Mar 25 00:41:06.275820 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:59775] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clcdu.php"] [unique_id "acK-oqS8TU_xcQFvlnb3FQAAABY"]
[Wed Mar 25 00:41:06.772028 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:60975] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wnwl19.php"] [unique_id "acK-oqS8TU_xcQFvlnb3FgAAABI"]
[Wed Mar 25 00:41:07.395996 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:60937] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wnwl19.php"] [unique_id "acK-o6S8TU_xcQFvlnb3GAAAAA4"]
[Wed Mar 25 00:41:07.888376 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:57726] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wnwl19.php"] [unique_id "acK-o6S8TU_xcQFvlnb3GgAAAAY"]
[Wed Mar 25 00:41:08.411386 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:60909] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wnwl19.php"] [unique_id "acK-pA0pGUh6bwD3ouJ_QgAAANM"]
[Wed Mar 25 00:41:08.920534 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60977] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drhunthq.php"] [unique_id "acK-pKS8TU_xcQFvlnb3HAAAAAs"]
[Wed Mar 25 00:41:09.416535 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:60239] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drhunthq.php"] [unique_id "acK-paS8TU_xcQFvlnb3HgAAAAU"]
[Wed Mar 25 00:41:09.997578 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:59652] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drhunthq.php"] [unique_id "acK-paS8TU_xcQFvlnb3HwAAABQ"]
[Wed Mar 25 00:41:10.527073 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59080] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drhunthq.php"] [unique_id "acK-pqS8TU_xcQFvlnb3IAAAABg"]
[Wed Mar 25 00:41:11.114826 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:61550] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "acK-p_IVQxDtjkklWGZPSwAAAEM"]
[Wed Mar 25 00:41:11.661537 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:59759] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "acK-p6S8TU_xcQFvlnb3IgAAAAQ"]
[Wed Mar 25 00:41:12.181358 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:59743] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "acK-qKLdPFdeRRktTdNOLwAAAIA"]
[Wed Mar 25 00:41:12.730820 2026] [:error] [pid 57702:tid 57915] [client 158.158.111.117:59081] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "acK-qKS8TU_xcQFvlnb3JQAAAAw"]
[Wed Mar 25 00:41:13.330514 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:61588] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Jcrop.php"] [unique_id "acK-qaLdPFdeRRktTdNOMwAAAIk"]
[Wed Mar 25 00:41:13.929319 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:59115] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Jcrop.php"] [unique_id "acK-qaS8TU_xcQFvlnb3JwAAABI"]
[Wed Mar 25 00:41:14.514347 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:60261] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Jcrop.php"] [unique_id "acK-qqS8TU_xcQFvlnb3KAAAAAA"]
[Wed Mar 25 00:41:15.028208 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59718] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Jcrop.php"] [unique_id "acK-qw0pGUh6bwD3ouJ_SgAAAMM"]
[Wed Mar 25 00:41:16.048895 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:60225] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rx.php"] [unique_id "acK-rKS8TU_xcQFvlnb3KQAAABE"]
[Wed Mar 25 00:41:17.195182 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59744] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rx.php"] [unique_id "acK-rQ0pGUh6bwD3ouJ_VAAAAMM"]
[Wed Mar 25 00:41:17.693355 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:60902] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rx.php"] [unique_id "acK-raLdPFdeRRktTdNONQAAAIQ"]
[Wed Mar 25 00:41:18.292583 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60277] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rx.php"] [unique_id "acK-rg0pGUh6bwD3ouJ_VwAAAMk"]
[Wed Mar 25 00:41:18.834894 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60335] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sup.php"] [unique_id "acK-rg0pGUh6bwD3ouJ_WAAAANA"]
[Wed Mar 25 00:41:19.438369 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:60956] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sup.php"] [unique_id "acK-r6S8TU_xcQFvlnb3KwAAABc"]
[Wed Mar 25 00:41:20.114443 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:60342] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sup.php"] [unique_id "acK-sKLdPFdeRRktTdNOOQAAAJQ"]
[Wed Mar 25 00:41:20.626888 2026] [:error] [pid 57703:tid 58042] [client 158.158.111.117:61606] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sup.php"] [unique_id "acK-sPIVQxDtjkklWGZPUgAAAFc"]
[Wed Mar 25 00:41:21.227194 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:59021] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asax.php"] [unique_id "acK-saS8TU_xcQFvlnb3LQAAABU"]
[Wed Mar 25 00:41:21.745822 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:58160] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asax.php"] [unique_id "acK-sQ0pGUh6bwD3ouJ_XQAAAMU"]
[Wed Mar 25 00:41:23.276626 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59070] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asax.php"] [unique_id "acK-s6S8TU_xcQFvlnb3MAAAABg"]
[Wed Mar 25 00:41:23.778274 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:61596] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asax.php"] [unique_id "acK-sw0pGUh6bwD3ouJ_YQAAAMY"]
[Wed Mar 25 00:41:24.388172 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:59748] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/assacc.php"] [unique_id "acK-tA0pGUh6bwD3ouJ_ZAAAAM8"]
[Wed Mar 25 00:41:24.911009 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:60947] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/assacc.php"] [unique_id "acK-tA0pGUh6bwD3ouJ_ZgAAAM4"]
[Wed Mar 25 00:41:25.448914 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:60349] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/assacc.php"] [unique_id "acK-taS8TU_xcQFvlnb3MwAAABM"]
[Wed Mar 25 00:41:25.998536 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:60990] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/assacc.php"] [unique_id "acK-taS8TU_xcQFvlnb3NQAAABI"]
[Wed Mar 25 00:41:26.572033 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:60890] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baixy.php"] [unique_id "acK-tvIVQxDtjkklWGZPWQAAAEc"]
[Wed Mar 25 00:41:27.136642 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:59736] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baixy.php"] [unique_id "acK-t6S8TU_xcQFvlnb3OQAAABc"]
[Wed Mar 25 00:41:27.650837 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:59648] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baixy.php"] [unique_id "acK-t6LdPFdeRRktTdNOPAAAAIA"]
[Wed Mar 25 00:41:28.233327 2026] [:error] [pid 57711:tid 58054] [client 158.158.111.117:60294] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baixy.php"] [unique_id "acK-uKLdPFdeRRktTdNOPQAAAIM"]
[Wed Mar 25 00:41:28.836091 2026] [:error] [pid 57703:tid 58038] [client 158.158.111.117:60345] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acK-uPIVQxDtjkklWGZPWwAAAFM"]
[Wed Mar 25 00:41:29.598181 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:60900] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acK-ufIVQxDtjkklWGZPXgAAAEQ"]
[Wed Mar 25 00:41:30.177411 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:61533] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acK-uvIVQxDtjkklWGZPYAAAAFU"]
[Wed Mar 25 00:41:30.821766 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:59651] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acK-uqS8TU_xcQFvlnb3QgAAAAk"]
[Wed Mar 25 00:41:31.391870 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:59070] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ak.php"] [unique_id "acK-u6LdPFdeRRktTdNOQgAAAJI"]
[Wed Mar 25 00:41:31.903760 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:60243] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ak.php"] [unique_id "acK-uw0pGUh6bwD3ouJ_cAAAANU"]
[Wed Mar 25 00:41:33.014389 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:60241] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ak.php"] [unique_id "acK-vQ0pGUh6bwD3ouJ_cQAAAMU"]
[Wed Mar 25 00:41:33.568871 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:59719] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ak.php"] [unique_id "acK-vQ0pGUh6bwD3ouJ_cwAAAMQ"]
[Wed Mar 25 00:41:34.135737 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:59658] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff.php"] [unique_id "acK-vg0pGUh6bwD3ouJ_dQAAAMs"]
[Wed Mar 25 00:41:34.721539 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:58217] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff.php"] [unique_id "acK-vg0pGUh6bwD3ouJ_eAAAAM8"]
[Wed Mar 25 00:41:35.219771 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60939] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff.php"] [unique_id "acK-vw0pGUh6bwD3ouJ_ewAAAMk"]
[Wed Mar 25 00:41:35.788478 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60987] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff.php"] [unique_id "acK-vw0pGUh6bwD3ouJ_fgAAANI"]
[Wed Mar 25 00:41:36.487818 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:59102] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfcl.php"] [unique_id "acK-wA0pGUh6bwD3ouJ_gQAAAMQ"]
[Wed Mar 25 00:41:37.127567 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:59725] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfcl.php"] [unique_id "acK-waLdPFdeRRktTdNOXgAAAII"]
[Wed Mar 25 00:41:38.102301 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:59745] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfcl.php"] [unique_id "acK-wg0pGUh6bwD3ouJ_hgAAAMk"]
[Wed Mar 25 00:41:38.808936 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:60344] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfcl.php"] [unique_id "acK-wg0pGUh6bwD3ouJ_iQAAANU"]
[Wed Mar 25 00:41:39.468836 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:60886] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tar17.php"] [unique_id "acK-w6LdPFdeRRktTdNOeQAAAIU"]
[Wed Mar 25 00:41:40.127932 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60935] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tar17.php"] [unique_id "acK-xA0pGUh6bwD3ouJ_jgAAAM8"]
[Wed Mar 25 00:41:40.801068 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:59113] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tar17.php"] [unique_id "acK-xKLdPFdeRRktTdNOiAAAAI4"]
[Wed Mar 25 00:41:41.733642 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:60965] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tar17.php"] [unique_id "acK-xQ0pGUh6bwD3ouJ_lAAAAMQ"]
[Wed Mar 25 00:41:42.270775 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59665] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rum.php"] [unique_id "acK-xg0pGUh6bwD3ouJ_mAAAAMw"]
[Wed Mar 25 00:41:42.780021 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:58212] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rum.php"] [unique_id "acK-xqLdPFdeRRktTdNOmgAAAI0"]
[Wed Mar 25 00:41:43.404433 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:60316] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rum.php"] [unique_id "acK-x6LdPFdeRRktTdNOogAAAJg"]
[Wed Mar 25 00:41:44.031621 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:58173] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rum.php"] [unique_id "acK-yKLdPFdeRRktTdNOrgAAAJE"]
[Wed Mar 25 00:41:44.674320 2026] [:error] [pid 57703:tid 58025] [client 158.158.111.117:59714] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2a2ck.php"] [unique_id "acK-yPIVQxDtjkklWGZPZwAAAEY"]
[Wed Mar 25 00:41:45.228943 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:61543] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2a2ck.php"] [unique_id "acK-yQ0pGUh6bwD3ouJ_oQAAAMA"]
[Wed Mar 25 00:41:45.754766 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:61631] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2a2ck.php"] [unique_id "acK-yaLdPFdeRRktTdNOwAAAAIs"]
[Wed Mar 25 00:41:46.712290 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:60895] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2a2ck.php"] [unique_id "acK-yvIVQxDtjkklWGZPagAAAEo"]
[Wed Mar 25 00:41:47.228152 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:59702] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/oowyi.php"] [unique_id "acK-y_IVQxDtjkklWGZPbAAAAEM"]
[Wed Mar 25 00:41:48.117100 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:58127] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/oowyi.php"] [unique_id "acK-zA0pGUh6bwD3ouJ_pQAAAMc"]
[Wed Mar 25 00:41:48.772027 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60255] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/oowyi.php"] [unique_id "acK-zKS8TU_xcQFvlnb3YQAAABY"]
[Wed Mar 25 00:41:49.272334 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:61519] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/oowyi.php"] [unique_id "acK-zaS8TU_xcQFvlnb3ZQAAABc"]
[Wed Mar 25 00:41:49.877272 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:61567] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acK-zaS8TU_xcQFvlnb3bQAAAAg"]
[Wed Mar 25 00:41:50.392058 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:58188] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acK-zqS8TU_xcQFvlnb3cwAAAAQ"]
[Wed Mar 25 00:41:51.015676 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59055] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acK-zw0pGUh6bwD3ouJ_qAAAAMI"]
[Wed Mar 25 00:41:51.583875 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:59066] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acK-z6S8TU_xcQFvlnb3ewAAAAU"]
[Wed Mar 25 00:41:52.133753 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:59679] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ge.php"] [unique_id "acK-0KS8TU_xcQFvlnb3gAAAABI"]
[Wed Mar 25 00:41:52.761667 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:59708] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ge.php"] [unique_id "acK-0PIVQxDtjkklWGZPbwAAAEE"]
[Wed Mar 25 00:41:53.365826 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:58117] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ge.php"] [unique_id "acK-0aLdPFdeRRktTdNO7wAAAJE"]
[Wed Mar 25 00:41:53.850132 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:57693] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ge.php"] [unique_id "acK-0aLdPFdeRRktTdNO9QAAAJM"]
[Wed Mar 25 00:41:54.351634 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:60274] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acK-0g0pGUh6bwD3ouJ_rQAAAMo"]
[Wed Mar 25 00:41:54.944680 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60918] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acK-0g0pGUh6bwD3ouJ_sAAAAMk"]
[Wed Mar 25 00:41:55.520851 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:59064] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acK-0w0pGUh6bwD3ouJ_swAAAMg"]
[Wed Mar 25 00:41:56.133317 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:59716] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acK-1PIVQxDtjkklWGZPdQAAAFg"]
[Wed Mar 25 00:41:56.695520 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:58204] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ssxsl.php"] [unique_id "acK-1A0pGUh6bwD3ouJ_twAAAME"]
[Wed Mar 25 00:41:57.237790 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:61600] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ssxsl.php"] [unique_id "acK-1aLdPFdeRRktTdNPBwAAAJY"]
[Wed Mar 25 00:41:57.792533 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:59739] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ssxsl.php"] [unique_id "acK-1aS8TU_xcQFvlnb3pAAAAA4"]
[Wed Mar 25 00:41:58.313413 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:58190] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ssxsl.php"] [unique_id "acK-1qS8TU_xcQFvlnb3pwAAAAk"]
[Wed Mar 25 00:41:58.831697 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:60258] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/str.php"] [unique_id "acK-1qS8TU_xcQFvlnb3rQAAABI"]
[Wed Mar 25 00:41:59.388379 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:59067] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/str.php"] [unique_id "acK-16LdPFdeRRktTdNPEwAAAJE"]
[Wed Mar 25 00:41:59.957941 2026] [:error] [pid 57711:tid 58060] [client 158.158.111.117:60962] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/str.php"] [unique_id "acK-16LdPFdeRRktTdNPGAAAAIg"]
[Wed Mar 25 00:42:18.108115 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:60864] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acK-6qLdPFdeRRktTdNPXwAAAIA"]
[Wed Mar 25 00:42:18.745570 2026] [:error] [pid 57703:tid 58025] [client 158.158.111.117:56839] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acK-6vIVQxDtjkklWGZPgAAAAEY"]
[Wed Mar 25 00:42:19.324747 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:60307] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acK-6_IVQxDtjkklWGZPggAAAEQ"]
[Wed Mar 25 00:42:20.003531 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59091] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0.php"] [unique_id "acK-7A0pGUh6bwD3ouJ_6AAAAMI"]
[Wed Mar 25 00:42:20.694504 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60235] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/F0x.php"] [unique_id "acK-7A0pGUh6bwD3ouJ_6wAAAM0"]
[Wed Mar 25 00:42:21.301437 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:61579] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/F0x.php"] [unique_id "acK-7Q0pGUh6bwD3ouJ_7QAAANY"]
[Wed Mar 25 00:42:21.887656 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:59056] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/F0x.php"] [unique_id "acK-7aLdPFdeRRktTdNPZQAAAIY"]
[Wed Mar 25 00:42:22.451489 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:60866] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/F0x.php"] [unique_id "acK-7vIVQxDtjkklWGZPiQAAAEE"]
[Wed Mar 25 00:42:23.071146 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:56940] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a/index.php"] [unique_id "acK-76LdPFdeRRktTdNPaQAAAIU"]
[Wed Mar 25 00:42:23.878871 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:59041] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a/index.php"] [unique_id "acK-76S8TU_xcQFvlnb4FgAAABI"]
[Wed Mar 25 00:42:24.507550 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:60916] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a/index.php"] [unique_id "acK-8KLdPFdeRRktTdNPagAAAI4"]
[Wed Mar 25 00:42:25.068664 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:59681] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a/index.php"] [unique_id "acK-8Q0pGUh6bwD3ouJ_9AAAAM8"]
[Wed Mar 25 00:42:25.583871 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:56398] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mail.php"] [unique_id "acK-8Q0pGUh6bwD3ouJ_9gAAANc"]
[Wed Mar 25 00:42:26.407241 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:56865] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mail.php"] [unique_id "acK-8g0pGUh6bwD3ouJ_-AAAAMU"]
[Wed Mar 25 00:42:26.933647 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59025] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mail.php"] [unique_id "acK-8g0pGUh6bwD3ouJ_-QAAAMw"]
[Wed Mar 25 00:42:27.526854 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:59699] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mail.php"] [unique_id "acK-8w0pGUh6bwD3ouJ__AAAANI"]
[Wed Mar 25 00:42:28.360044 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:58148] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fan.php"] [unique_id "acK-9A0pGUh6bwD3ouJ__wAAAM0"]
[Wed Mar 25 00:42:28.887048 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:59741] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fan.php"] [unique_id "acK-9KS8TU_xcQFvlnb4HgAAAAg"]
[Wed Mar 25 00:42:29.488461 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:61535] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fan.php"] [unique_id "acK-9Q0pGUh6bwD3ouKAAgAAAMY"]
[Wed Mar 25 00:42:30.241443 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59753] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fan.php"] [unique_id "acK-9qS8TU_xcQFvlnb4IgAAABg"]
[Wed Mar 25 00:42:30.964349 2026] [:error] [pid 57703:tid 58034] [client 158.158.111.117:59749] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ztv.php"] [unique_id "acK-9vIVQxDtjkklWGZPjgAAAE8"]
[Wed Mar 25 00:42:31.617138 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:61508] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ztv.php"] [unique_id "acK-9w0pGUh6bwD3ouKACgAAANc"]
[Wed Mar 25 00:42:32.364306 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:59127] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ztv.php"] [unique_id "acK--A0pGUh6bwD3ouKADAAAAMU"]
[Wed Mar 25 00:42:32.855535 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:59717] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ztv.php"] [unique_id "acK--KLdPFdeRRktTdNPbwAAAII"]
[Wed Mar 25 00:42:33.507997 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:61623] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bras.php"] [unique_id "acK--Q0pGUh6bwD3ouKAEgAAAM8"]
[Wed Mar 25 00:42:37.157321 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:61505] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bras.php"] [unique_id "acK-_Q0pGUh6bwD3ouKAIQAAANQ"]
[Wed Mar 25 00:43:11.405539 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59689] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpup.php"] [unique_id "acK_Hw0pGUh6bwD3ouKAhAAAAMw"]
[Wed Mar 25 00:43:12.111189 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:59031] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpup.php"] [unique_id "acK_IA0pGUh6bwD3ouKAhQAAANI"]
[Wed Mar 25 00:43:12.802004 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60317] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpup.php"] [unique_id "acK_IA0pGUh6bwD3ouKAiAAAAM8"]
[Wed Mar 25 00:43:13.453161 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:59112] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpup.php"] [unique_id "acK_IaS8TU_xcQFvlnb4UwAAAAs"]
[Wed Mar 25 00:43:14.133891 2026] [:error] [pid 57711:tid 58054] [client 158.158.111.117:59713] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x50.php"] [unique_id "acK_IqLdPFdeRRktTdNPjwAAAIM"]
[Wed Mar 25 00:43:14.708057 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:59663] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x50.php"] [unique_id "acK_IvIVQxDtjkklWGZPswAAAFg"]
[Wed Mar 25 00:43:15.247757 2026] [:error] [pid 57711:tid 58075] [client 158.158.111.117:60321] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x50.php"] [unique_id "acK_I6LdPFdeRRktTdNPkgAAAJU"]
[Wed Mar 25 00:43:15.890775 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:60880] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x50.php"] [unique_id "acK_I6LdPFdeRRktTdNPmAAAAIs"]
[Wed Mar 25 00:43:16.587590 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59128] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mt/pekok.php"] [unique_id "acK_JA0pGUh6bwD3ouKAjAAAAMw"]
[Wed Mar 25 00:43:34.671164 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:58224] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sf9.php"] [unique_id "acK_Ng0pGUh6bwD3ouKA5wAAAMk"]
[Wed Mar 25 00:43:35.165077 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60911] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sf9.php"] [unique_id "acK_Nw0pGUh6bwD3ouKA6QAAAM0"]
[Wed Mar 25 00:43:35.725364 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:59655] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sf9.php"] [unique_id "acK_N6S8TU_xcQFvlnb4bQAAAAQ"]
[Wed Mar 25 00:43:36.266212 2026] [:error] [pid 57703:tid 58042] [client 158.158.111.117:61506] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sf9.php"] [unique_id "acK_OPIVQxDtjkklWGZPwgAAAFc"]
[Wed Mar 25 00:43:36.891875 2026] [:error] [pid 57703:tid 58033] [client 158.158.111.117:59676] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acK_OPIVQxDtjkklWGZPxQAAAE4"]
[Wed Mar 25 00:43:37.410998 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:58185] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acK_OaLdPFdeRRktTdNPqwAAAIo"]
[Wed Mar 25 00:43:37.989561 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:59032] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acK_OaS8TU_xcQFvlnb4cAAAAAE"]
[Wed Mar 25 00:43:38.628779 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:60893] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5b9ac.php"] [unique_id "acK_OvIVQxDtjkklWGZPxwAAAEg"]
[Wed Mar 25 00:43:39.156177 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60259] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "acK_Ow0pGUh6bwD3ouKA8gAAAM8"]
[Wed Mar 25 00:43:39.708083 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:60337] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "acK_O_IVQxDtjkklWGZPyAAAAEw"]
[Wed Mar 25 00:43:40.446683 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:60280] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "acK_PA0pGUh6bwD3ouKA-gAAAM4"]
[Wed Mar 25 00:43:41.062640 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:58191] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "acK_PQ0pGUh6bwD3ouKA_wAAAMY"]
[Wed Mar 25 00:43:41.664191 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:61512] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acK_PQ0pGUh6bwD3ouKBBQAAAMA"]
[Wed Mar 25 00:43:42.215203 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:61565] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acK_PqS8TU_xcQFvlnb4cgAAABM"]
[Wed Mar 25 00:43:42.804517 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:61528] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acK_PvIVQxDtjkklWGZPzAAAAEQ"]
[Wed Mar 25 00:43:43.386178 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60236] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acK_Pw0pGUh6bwD3ouKBCgAAAMM"]
[Wed Mar 25 00:43:43.885985 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:61618] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dump.php"] [unique_id "acK_P_IVQxDtjkklWGZP0AAAAEM"]
[Wed Mar 25 00:43:44.467346 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:59693] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dump.php"] [unique_id "acK_QKLdPFdeRRktTdNPsAAAAIY"]
[Wed Mar 25 00:43:45.088018 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:60235] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dump.php"] [unique_id "acK_QfIVQxDtjkklWGZP0QAAAFE"]
[Wed Mar 25 00:43:45.616135 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60912] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dump.php"] [unique_id "acK_QaS8TU_xcQFvlnb4fQAAAAc"]
[Wed Mar 25 00:43:46.166765 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60279] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xx.php"] [unique_id "acK_Qg0pGUh6bwD3ouKBDAAAANY"]
[Wed Mar 25 00:43:46.778501 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:57643] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xx.php"] [unique_id "acK_QqS8TU_xcQFvlnb4fwAAAAU"]
[Wed Mar 25 00:43:47.391989 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:61536] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xx.php"] [unique_id "acK_Q6S8TU_xcQFvlnb4gQAAAAs"]
[Wed Mar 25 00:43:48.002064 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:57669] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xx.php"] [unique_id "acK_RA0pGUh6bwD3ouKBDwAAAMY"]
[Wed Mar 25 00:43:48.598678 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:58131] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a.php"] [unique_id "acK_RKS8TU_xcQFvlnb4hAAAAA4"]
[Wed Mar 25 00:43:49.088835 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:59755] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a.php"] [unique_id "acK_RaS8TU_xcQFvlnb4hQAAABU"]
[Wed Mar 25 00:43:49.729336 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:61551] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a.php"] [unique_id "acK_RaLdPFdeRRktTdNPvwAAAI8"]
[Wed Mar 25 00:43:50.283658 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:59061] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a.php"] [unique_id "acK_RqS8TU_xcQFvlnb4iQAAAAI"]
[Wed Mar 25 00:43:50.805968 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:60953] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "acK_RvIVQxDtjkklWGZP4AAAAFU"]
[Wed Mar 25 00:43:51.380063 2026] [:error] [pid 57702:tid 57916] [client 158.158.111.117:57682] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "acK_R6S8TU_xcQFvlnb4jQAAAA0"]
[Wed Mar 25 00:43:52.023913 2026] [:error] [pid 57703:tid 58024] [client 158.158.111.117:57673] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "acK_SPIVQxDtjkklWGZP5wAAAEU"]
[Wed Mar 25 00:43:52.600525 2026] [:error] [pid 57703:tid 58041] [client 158.158.111.117:59738] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock360.php"] [unique_id "acK_SPIVQxDtjkklWGZP6QAAAFY"]
[Wed Mar 25 00:43:53.183173 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:60921] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/np.php"] [unique_id "acK_SfIVQxDtjkklWGZP6gAAAE0"]
[Wed Mar 25 00:43:53.713547 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60232] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/np.php"] [unique_id "acK_SQ0pGUh6bwD3ouKBEQAAAMw"]
[Wed Mar 25 00:43:54.246716 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:60351] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/np.php"] [unique_id "acK_Sg0pGUh6bwD3ouKBFAAAAMo"]
[Wed Mar 25 00:43:54.832438 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61541] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/np.php"] [unique_id "acK_Sg0pGUh6bwD3ouKBFQAAANU"]
[Wed Mar 25 00:43:55.460378 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60250] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx1.php"] [unique_id "acK_Sw0pGUh6bwD3ouKBGAAAAM0"]
[Wed Mar 25 00:43:55.944265 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:60982] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx1.php"] [unique_id "acK_Sw0pGUh6bwD3ouKBGgAAAM4"]
[Wed Mar 25 00:43:57.180171 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59653] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx1.php"] [unique_id "acK_TQ0pGUh6bwD3ouKBHAAAAMA"]
[Wed Mar 25 00:43:57.743517 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:59039] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx1.php"] [unique_id "acK_TQ0pGUh6bwD3ouKBHgAAAME"]
[Wed Mar 25 00:43:58.389028 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60251] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs.php"] [unique_id "acK_Tg0pGUh6bwD3ouKBHwAAANc"]
[Wed Mar 25 00:43:58.965928 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:58153] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs.php"] [unique_id "acK_TqS8TU_xcQFvlnb4mwAAAAQ"]
[Wed Mar 25 00:43:59.454615 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:59105] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs.php"] [unique_id "acK_T6LdPFdeRRktTdNPyQAAAJM"]
[Wed Mar 25 00:43:59.938093 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:61561] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs.php"] [unique_id "acK_Tw0pGUh6bwD3ouKBIAAAANE"]
[Wed Mar 25 00:44:00.567850 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:57628] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/good.php"] [unique_id "acK_UKS8TU_xcQFvlnb4nAAAABU"]
[Wed Mar 25 00:44:01.137866 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:58122] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/good.php"] [unique_id "acK_UaS8TU_xcQFvlnb4nwAAAAA"]
[Wed Mar 25 00:44:01.627357 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:61572] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/good.php"] [unique_id "acK_UQ0pGUh6bwD3ouKBJQAAAMs"]
[Wed Mar 25 00:44:02.171141 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:59774] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/good.php"] [unique_id "acK_UqS8TU_xcQFvlnb4oQAAAAk"]
[Wed Mar 25 00:44:02.680187 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:56875] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/haxor.php"] [unique_id "acK_Ug0pGUh6bwD3ouKBJgAAAM4"]
[Wed Mar 25 00:44:03.238937 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60339] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/haxor.php"] [unique_id "acK_Uw0pGUh6bwD3ouKBKAAAAMg"]
[Wed Mar 25 00:44:03.830114 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60237] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/haxor.php"] [unique_id "acK_Uw0pGUh6bwD3ouKBKgAAAMk"]
[Wed Mar 25 00:44:04.379002 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:57677] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/haxor.php"] [unique_id "acK_VKLdPFdeRRktTdNPzAAAAIs"]
[Wed Mar 25 00:44:04.947442 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:61573] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "acK_VKLdPFdeRRktTdNPzwAAAJI"]
[Wed Mar 25 00:44:05.451536 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:60322] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "acK_VQ0pGUh6bwD3ouKBLgAAANE"]
[Wed Mar 25 00:44:06.058209 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:59721] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "acK_Vg0pGUh6bwD3ouKBNAAAAMc"]
[Wed Mar 25 00:44:06.652612 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60940] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/z.php"] [unique_id "acK_Vg0pGUh6bwD3ouKBNwAAAMM"]
[Wed Mar 25 00:44:07.224126 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:58203] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gg.php"] [unique_id "acK_Vw0pGUh6bwD3ouKBOgAAAMY"]
[Wed Mar 25 00:44:07.783478 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:61542] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gg.php"] [unique_id "acK_Vw0pGUh6bwD3ouKBPQAAAMQ"]
[Wed Mar 25 00:44:08.332701 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:59062] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gg.php"] [unique_id "acK_WA0pGUh6bwD3ouKBQwAAANA"]
[Wed Mar 25 00:44:08.831245 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:59760] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gg.php"] [unique_id "acK_WA0pGUh6bwD3ouKBRwAAAM8"]
[Wed Mar 25 00:44:09.394620 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:60868] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/14.php"] [unique_id "acK_WaS8TU_xcQFvlnb4rAAAAAk"]
[Wed Mar 25 00:44:09.966628 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:60925] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/14.php"] [unique_id "acK_WaLdPFdeRRktTdNP0QAAAIw"]
[Wed Mar 25 00:44:10.484012 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:59125] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/14.php"] [unique_id "acK_WvIVQxDtjkklWGZP_gAAAEs"]
[Wed Mar 25 00:44:11.066417 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:61574] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/14.php"] [unique_id "acK_W6LdPFdeRRktTdNP2QAAAIo"]
[Wed Mar 25 00:44:12.190180 2026] [:error] [pid 57703:tid 58041] [client 158.158.111.117:60331] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6erg.php"] [unique_id "acK_XPIVQxDtjkklWGZQAQAAAFY"]
[Wed Mar 25 00:44:12.694079 2026] [:error] [pid 57703:tid 58028] [client 158.158.111.117:59762] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6erg.php"] [unique_id "acK_XPIVQxDtjkklWGZQAgAAAEk"]
[Wed Mar 25 00:44:13.283098 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:59758] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6erg.php"] [unique_id "acK_XQ0pGUh6bwD3ouKBTAAAAMc"]
[Wed Mar 25 00:44:13.828916 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:56873] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6erg.php"] [unique_id "acK_XaLdPFdeRRktTdNP4AAAAIY"]
[Wed Mar 25 00:44:14.508518 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:61622] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d7.php"] [unique_id "acK_XqLdPFdeRRktTdNP4gAAAIQ"]
[Wed Mar 25 00:44:15.253150 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60231] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d7.php"] [unique_id "acK_Xw0pGUh6bwD3ouKBUAAAANc"]
[Wed Mar 25 00:44:15.788633 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:57680] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d7.php"] [unique_id "acK_X6S8TU_xcQFvlnb4twAAAAE"]
[Wed Mar 25 00:44:16.485728 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:57681] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d7.php"] [unique_id "acK_YA0pGUh6bwD3ouKBWwAAAMM"]
[Wed Mar 25 00:44:17.052793 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:59037] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/idea.php"] [unique_id "acK_YaS8TU_xcQFvlnb4uQAAAAk"]
[Wed Mar 25 00:44:17.681568 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:60233] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/idea.php"] [unique_id "acK_YaLdPFdeRRktTdNP5QAAAJA"]
[Wed Mar 25 00:44:18.355118 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:59114] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/idea.php"] [unique_id "acK_YqS8TU_xcQFvlnb4uwAAAAI"]
[Wed Mar 25 00:44:19.326098 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:59726] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/idea.php"] [unique_id "acK_Y6LdPFdeRRktTdNP6wAAAIY"]
[Wed Mar 25 00:44:19.868749 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:60240] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/error_log.php"] [unique_id "acK_Yw0pGUh6bwD3ouKBZgAAANQ"]
[Wed Mar 25 00:44:20.382600 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:61549] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/error_log.php"] [unique_id "acK_ZA0pGUh6bwD3ouKBaAAAANg"]
[Wed Mar 25 00:44:21.005741 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:58121] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/error_log.php"] [unique_id "acK_ZQ0pGUh6bwD3ouKBaQAAANE"]
[Wed Mar 25 00:44:21.539535 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:61578] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/error_log.php"] [unique_id "acK_ZQ0pGUh6bwD3ouKBbgAAAMA"]
[Wed Mar 25 00:44:22.056610 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:60303] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acK_ZqS8TU_xcQFvlnb4vAAAABE"]
[Wed Mar 25 00:44:22.777490 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:60300] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acK_ZqS8TU_xcQFvlnb4vwAAAAg"]
[Wed Mar 25 00:44:23.325673 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:58120] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acK_Z6S8TU_xcQFvlnb4wAAAAAQ"]
[Wed Mar 25 00:44:24.126779 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:59768] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acK_aA0pGUh6bwD3ouKBdgAAAMc"]
[Wed Mar 25 00:44:24.680695 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:59687] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geju.php"] [unique_id "acK_aKLdPFdeRRktTdNP8AAAAJA"]
[Wed Mar 25 00:44:25.313508 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:60931] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geju.php"] [unique_id "acK_aaLdPFdeRRktTdNP8QAAAJE"]
[Wed Mar 25 00:44:26.162182 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:60239] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geju.php"] [unique_id "acK_aqLdPFdeRRktTdNP8gAAAIo"]
[Wed Mar 25 00:44:26.830147 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:58139] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geju.php"] [unique_id "acK_aqS8TU_xcQFvlnb4yAAAABM"]
[Wed Mar 25 00:44:27.585088 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:59766] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fesa.php"] [unique_id "acK_a6S8TU_xcQFvlnb4zAAAAAc"]
[Wed Mar 25 00:44:28.162356 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:61630] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fesa.php"] [unique_id "acK_bKS8TU_xcQFvlnb4zwAAAAQ"]
[Wed Mar 25 00:44:28.701685 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:59727] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fesa.php"] [unique_id "acK_bPIVQxDtjkklWGZQDgAAAEg"]
[Wed Mar 25 00:44:29.446501 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:61574] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fesa.php"] [unique_id "acK_bQ0pGUh6bwD3ouKBewAAAMs"]
[Wed Mar 25 00:44:30.051618 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:60927] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "acK_bg0pGUh6bwD3ouKBfQAAAMI"]
[Wed Mar 25 00:44:30.728346 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:58202] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "acK_bqS8TU_xcQFvlnb42gAAAA8"]
[Wed Mar 25 00:44:31.399692 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:59042] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "acK_bw0pGUh6bwD3ouKBgQAAANg"]
[Wed Mar 25 00:44:31.962487 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:60333] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "acK_bw0pGUh6bwD3ouKBgwAAANE"]
[Wed Mar 25 00:44:32.655314 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:60305] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alex.php"] [unique_id "acK_cA0pGUh6bwD3ouKBhwAAAM4"]
[Wed Mar 25 00:44:49.337794 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59767] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/budmachine/web/s.php"] [unique_id "acK_gQ0pGUh6bwD3ouKBzAAAAM0"]
[Wed Mar 25 00:44:50.046062 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:59728] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/budmachine/web/s.php"] [unique_id "acK_gqLdPFdeRRktTdNQBAAAAIQ"]
[Wed Mar 25 00:44:50.644175 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:60943] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/budmachine/web/s.php"] [unique_id "acK_gqS8TU_xcQFvlnb49QAAABU"]
[Wed Mar 25 00:44:51.264606 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:61594] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/budmachine/web/s.php"] [unique_id "acK_g6S8TU_xcQFvlnb49gAAAAI"]
[Wed Mar 25 00:44:51.972880 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:61560] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qvaaq.php"] [unique_id "acK_g6S8TU_xcQFvlnb49wAAABI"]
[Wed Mar 25 00:44:52.541670 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:59764] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qvaaq.php"] [unique_id "acK_hA0pGUh6bwD3ouKB1gAAAM8"]
[Wed Mar 25 00:44:53.229494 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:60971] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qvaaq.php"] [unique_id "acK_haS8TU_xcQFvlnb4-QAAABg"]
[Wed Mar 25 00:44:53.834919 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:58236] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qvaaq.php"] [unique_id "acK_hfIVQxDtjkklWGZQKQAAAEo"]
[Wed Mar 25 00:44:54.490426 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:61548] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "acK_hqLdPFdeRRktTdNQDgAAAJg"]
[Wed Mar 25 00:44:55.035575 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:60313] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "acK_h6LdPFdeRRktTdNQEQAAAJI"]
[Wed Mar 25 00:44:55.628449 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:55708] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "acK_hw0pGUh6bwD3ouKB3AAAAMI"]
[Wed Mar 25 00:44:56.172631 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:61505] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/m.php"] [unique_id "acK_iA0pGUh6bwD3ouKB3gAAAMk"]
[Wed Mar 25 00:44:56.725629 2026] [:error] [pid 57702:tid 57915] [client 158.158.111.117:58213] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahy66.php"] [unique_id "acK_iKS8TU_xcQFvlnb5AgAAAAw"]
[Wed Mar 25 00:44:57.216869 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:58137] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahy66.php"] [unique_id "acK_iQ0pGUh6bwD3ouKB4gAAAMw"]
[Wed Mar 25 00:44:57.803091 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:59016] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahy66.php"] [unique_id "acK_iaLdPFdeRRktTdNQEwAAAIc"]
[Wed Mar 25 00:44:58.284433 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:61613] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ahy66.php"] [unique_id "acK_iqLdPFdeRRktTdNQFwAAAJE"]
[Wed Mar 25 00:44:58.828087 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:61595] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bala.php"] [unique_id "acK_ig0pGUh6bwD3ouKB6QAAAMc"]
[Wed Mar 25 00:44:59.337804 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60256] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bala.php"] [unique_id "acK_i6S8TU_xcQFvlnb5CAAAAAc"]
[Wed Mar 25 00:44:59.874903 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:59740] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bala.php"] [unique_id "acK_iw0pGUh6bwD3ouKB6wAAAMs"]
[Wed Mar 25 00:45:00.404715 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60325] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bala.php"] [unique_id "acK_jA0pGUh6bwD3ouKB7QAAAMw"]
[Wed Mar 25 00:45:00.969883 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60896] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/beence.php"] [unique_id "acK_jA0pGUh6bwD3ouKB7wAAANY"]
[Wed Mar 25 00:45:01.666078 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:59082] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/beence.php"] [unique_id "acK_jQ0pGUh6bwD3ouKB8QAAAMg"]
[Wed Mar 25 00:45:02.215795 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60247] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/beence.php"] [unique_id "acK_jqS8TU_xcQFvlnb5EQAAABY"]
[Wed Mar 25 00:45:02.746525 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:61544] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/beence.php"] [unique_id "acK_jqLdPFdeRRktTdNQGwAAAIs"]
[Wed Mar 25 00:45:03.507575 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60897] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-2018.php"] [unique_id "acK_jw0pGUh6bwD3ouKB9gAAAM8"]
[Wed Mar 25 00:45:04.031160 2026] [:error] [pid 57703:tid 58039] [client 158.158.111.117:61584] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-2018.php"] [unique_id "acK_kPIVQxDtjkklWGZQKgAAAFQ"]
[Wed Mar 25 00:45:04.586433 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61563] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-2018.php"] [unique_id "acK_kA0pGUh6bwD3ouKB_AAAANU"]
[Wed Mar 25 00:45:05.118971 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60922] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-2018.php"] [unique_id "acK_kQ0pGUh6bwD3ouKCAAAAAMA"]
[Wed Mar 25 00:45:05.717496 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:60299] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest3.php"] [unique_id "acK_kaLdPFdeRRktTdNQIAAAAIE"]
[Wed Mar 25 00:45:06.228021 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:59715] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest3.php"] [unique_id "acK_kg0pGUh6bwD3ouKCBQAAAMo"]
[Wed Mar 25 00:45:06.729093 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:60273] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest3.php"] [unique_id "acK_kqLdPFdeRRktTdNQIwAAAJA"]
[Wed Mar 25 00:45:07.346398 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:58114] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest3.php"] [unique_id "acK_kw0pGUh6bwD3ouKCCAAAANU"]
[Wed Mar 25 00:45:07.919901 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60336] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baxa1.phP"] [unique_id "acK_kw0pGUh6bwD3ouKCCQAAANA"]
[Wed Mar 25 00:45:08.524705 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:56943] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baxa1.phP"] [unique_id "acK_lKS8TU_xcQFvlnb5FAAAAAI"]
[Wed Mar 25 00:45:09.156318 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:59656] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baxa1.phP"] [unique_id "acK_lfIVQxDtjkklWGZQNAAAAEo"]
[Wed Mar 25 00:45:09.859334 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59009] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/baxa1.phP"] [unique_id "acK_lQ0pGUh6bwD3ouKCCwAAAMM"]
[Wed Mar 25 00:45:10.393501 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:60242] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acK_lqS8TU_xcQFvlnb5GAAAABM"]
[Wed Mar 25 00:46:11.090291 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:59763] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "acK_0_IVQxDtjkklWGZQdQAAAFU"]
[Wed Mar 25 00:46:12.974410 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:59719] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s1.php"] [unique_id "acK_1A0pGUh6bwD3ouKCuAAAANQ"]
[Wed Mar 25 00:46:13.582823 2026] [:error] [pid 57703:tid 58034] [client 158.158.111.117:60923] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s1.php"] [unique_id "acK_1fIVQxDtjkklWGZQdgAAAE8"]
[Wed Mar 25 00:46:14.094900 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:59731] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s1.php"] [unique_id "acK_1g0pGUh6bwD3ouKCugAAAMk"]
[Wed Mar 25 00:46:14.665750 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:61540] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s1.php"] [unique_id "acK_1g0pGUh6bwD3ouKCvQAAAMg"]
[Wed Mar 25 00:46:15.195262 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:59701] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelay.php"] [unique_id "acK_1w0pGUh6bwD3ouKCwQAAAME"]
[Wed Mar 25 00:46:15.820678 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:60887] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelay.php"] [unique_id "acK_1_IVQxDtjkklWGZQeQAAAEs"]
[Wed Mar 25 00:46:16.552073 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:59763] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelay.php"] [unique_id "acK_2KLdPFdeRRktTdNQhQAAAJQ"]
[Wed Mar 25 00:46:17.099523 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59733] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gelay.php"] [unique_id "acK_2Q0pGUh6bwD3ouKCywAAAM0"]
[Wed Mar 25 00:46:17.617418 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60975] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kdgok.php"] [unique_id "acK_2aS8TU_xcQFvlnb5kQAAAAs"]
[Wed Mar 25 00:46:18.253619 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:61537] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kdgok.php"] [unique_id "acK_2qLdPFdeRRktTdNQjQAAAIQ"]
[Wed Mar 25 00:46:18.744887 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60914] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kdgok.php"] [unique_id "acK_2qS8TU_xcQFvlnb5mgAAABY"]
[Wed Mar 25 00:46:19.261013 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:59742] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kdgok.php"] [unique_id "acK_26LdPFdeRRktTdNQkwAAAIc"]
[Wed Mar 25 00:46:19.808084 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:60318] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ijNdPI1Orya.php"] [unique_id "acK_26LdPFdeRRktTdNQlQAAAI4"]
[Wed Mar 25 00:46:20.411757 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:59670] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ijNdPI1Orya.php"] [unique_id "acK_3KLdPFdeRRktTdNQmAAAAIA"]
[Wed Mar 25 00:46:21.012465 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:59770] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ijNdPI1Orya.php"] [unique_id "acK_3Q0pGUh6bwD3ouKC0gAAANQ"]
[Wed Mar 25 00:46:21.581985 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:58180] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ijNdPI1Orya.php"] [unique_id "acK_3aLdPFdeRRktTdNQngAAAIY"]
[Wed Mar 25 00:46:22.095779 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59116] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acK_3g0pGUh6bwD3ouKC0wAAAMw"]
[Wed Mar 25 00:46:22.617497 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59661] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acK_3qS8TU_xcQFvlnb5ngAAABg"]
[Wed Mar 25 00:46:23.121838 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:59725] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acK_3w0pGUh6bwD3ouKC1QAAAMk"]
[Wed Mar 25 00:46:23.668520 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:61587] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acK_3w0pGUh6bwD3ouKC1gAAAMg"]
[Wed Mar 25 00:46:24.260054 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60962] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qaez.php56"] [unique_id "acK_4A0pGUh6bwD3ouKC1wAAAMM"]
[Wed Mar 25 00:46:24.783184 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:59756] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qaez.php56"] [unique_id "acK_4A0pGUh6bwD3ouKC2wAAAM4"]
[Wed Mar 25 00:46:25.363069 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:59747] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qaez.php56"] [unique_id "acK_4aLdPFdeRRktTdNQsgAAAII"]
[Wed Mar 25 00:46:25.878598 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:58166] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qaez.php56"] [unique_id "acK_4Q0pGUh6bwD3ouKC4AAAANQ"]
[Wed Mar 25 00:46:26.418974 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:60867] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alog.php"] [unique_id "acK_4qS8TU_xcQFvlnb5oQAAAAI"]
[Wed Mar 25 00:46:27.170134 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60930] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alog.php"] [unique_id "acK_46S8TU_xcQFvlnb5ogAAAAc"]
[Wed Mar 25 00:46:27.814785 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:60346] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alog.php"] [unique_id "acK_46S8TU_xcQFvlnb5pgAAABc"]
[Wed Mar 25 00:46:28.363975 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:58159] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alog.php"] [unique_id "acK_5KS8TU_xcQFvlnb5qgAAAAE"]
[Wed Mar 25 00:46:28.921363 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:61621] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "acK_5A0pGUh6bwD3ouKC5wAAAMA"]
[Wed Mar 25 00:46:29.516218 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60979] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "acK_5Q0pGUh6bwD3ouKC6QAAAMY"]
[Wed Mar 25 00:46:30.134591 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:60301] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "acK_5qS8TU_xcQFvlnb5swAAAA8"]
[Wed Mar 25 00:46:30.701519 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59100] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cok.php"] [unique_id "acK_5g0pGUh6bwD3ouKC7QAAANc"]
[Wed Mar 25 00:46:31.325855 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:60350] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amphicyon.php"] [unique_id "acK_56S8TU_xcQFvlnb5tgAAABI"]
[Wed Mar 25 00:46:32.045834 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59058] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amphicyon.php"] [unique_id "acK_6A0pGUh6bwD3ouKC8QAAAMM"]
[Wed Mar 25 00:46:32.652431 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:59696] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amphicyon.php"] [unique_id "acK_6A0pGUh6bwD3ouKC9AAAAMo"]
[Wed Mar 25 00:46:33.299821 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60915] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amphicyon.php"] [unique_id "acK_6aLdPFdeRRktTdNQwQAAAII"]
[Wed Mar 25 00:46:33.863310 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:60302] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tesla.php"] [unique_id "acK_6aLdPFdeRRktTdNQxwAAAIQ"]
[Wed Mar 25 00:46:34.396565 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:61576] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tesla.php"] [unique_id "acK_6qLdPFdeRRktTdNQygAAAIY"]
[Wed Mar 25 00:46:34.908522 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61519] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tesla.php"] [unique_id "acK_6g0pGUh6bwD3ouKC-gAAANU"]
[Wed Mar 25 00:46:35.434571 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59716] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tesla.php"] [unique_id "acK_6w0pGUh6bwD3ouKC_QAAANc"]
[Wed Mar 25 00:46:35.920567 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:61599] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acK_66S8TU_xcQFvlnb5uwAAAAU"]
[Wed Mar 25 00:46:36.487756 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:60967] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acK_7KLdPFdeRRktTdNQzAAAAIE"]
[Wed Mar 25 00:46:37.043014 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:59129] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acK_7fIVQxDtjkklWGZQjgAAAFg"]
[Wed Mar 25 00:46:37.644494 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:61607] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acK_7Q0pGUh6bwD3ouKDAAAAAM8"]
[Wed Mar 25 00:46:38.220581 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:59650] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/my1.php"] [unique_id "acK_7qS8TU_xcQFvlnb5vQAAABE"]
[Wed Mar 25 00:46:38.770300 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:59739] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/my1.php"] [unique_id "acK_7g0pGUh6bwD3ouKDBgAAANM"]
[Wed Mar 25 00:46:39.308156 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:59736] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/my1.php"] [unique_id "acK_7w0pGUh6bwD3ouKDCAAAANI"]
[Wed Mar 25 00:46:39.830191 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:59693] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/my1.php"] [unique_id "acK_7w0pGUh6bwD3ouKDCgAAANg"]
[Wed Mar 25 00:46:40.479292 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:60265] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/990.php"] [unique_id "acK_8KS8TU_xcQFvlnb5wwAAAAA"]
[Wed Mar 25 00:46:41.717827 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:60312] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/990.php"] [unique_id "acK_8fIVQxDtjkklWGZQlAAAAEs"]
[Wed Mar 25 00:46:42.309170 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:59717] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/990.php"] [unique_id "acK_8vIVQxDtjkklWGZQlQAAAEE"]
[Wed Mar 25 00:46:42.855812 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:59759] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/990.php"] [unique_id "acK_8g0pGUh6bwD3ouKDFgAAAM8"]
[Wed Mar 25 00:46:43.376719 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59772] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "acK_8w0pGUh6bwD3ouKDIAAAAMA"]
[Wed Mar 25 00:46:43.872595 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:59657] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "acK_86LdPFdeRRktTdNQ3QAAAI8"]
[Wed Mar 25 00:46:44.365066 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:57671] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "acK_9PIVQxDtjkklWGZQmQAAAEg"]
[Wed Mar 25 00:46:44.984108 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:59724] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aaa.php"] [unique_id "acK_9KLdPFdeRRktTdNQ4gAAAIQ"]
[Wed Mar 25 00:46:45.498513 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:58175] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acK_9fIVQxDtjkklWGZQnAAAAFg"]
[Wed Mar 25 00:46:46.024854 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:61520] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acK_9vIVQxDtjkklWGZQngAAAEA"]
[Wed Mar 25 00:46:46.660918 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:58158] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acK_9qS8TU_xcQFvlnb50AAAABM"]
[Wed Mar 25 00:46:47.275784 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:59649] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/az.php"] [unique_id "acK_96S8TU_xcQFvlnb50wAAAA4"]
[Wed Mar 25 00:46:47.769520 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:61588] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh.php"] [unique_id "acK_96S8TU_xcQFvlnb51gAAAAs"]
[Wed Mar 25 00:46:48.276209 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:59021] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh.php"] [unique_id "acK_-PIVQxDtjkklWGZQoQAAAEo"]
[Wed Mar 25 00:46:48.957449 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:59087] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh.php"] [unique_id "acK_-A0pGUh6bwD3ouKDJgAAAMY"]
[Wed Mar 25 00:46:49.507507 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:58219] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sh.php"] [unique_id "acK_-fIVQxDtjkklWGZQpAAAAEE"]
[Wed Mar 25 00:46:50.064569 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:60269] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "acK_-qS8TU_xcQFvlnb52wAAAAA"]
[Wed Mar 25 00:46:50.618839 2026] [:error] [pid 57702:tid 57913] [client 158.158.111.117:60275] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "acK_-qS8TU_xcQFvlnb53gAAAAo"]
[Wed Mar 25 00:46:51.286817 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:60245] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "acK_-6LdPFdeRRktTdNQ-AAAAJg"]
[Wed Mar 25 00:46:51.783644 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:60295] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ot.php"] [unique_id "acK_-_IVQxDtjkklWGZQpwAAAFE"]
[Wed Mar 25 00:46:52.348779 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:60889] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13ede.php"] [unique_id "acK__KLdPFdeRRktTdNQ_QAAAIc"]
[Wed Mar 25 00:46:52.919218 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:60286] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13ede.php"] [unique_id "acK__PIVQxDtjkklWGZQqgAAAE0"]
[Wed Mar 25 00:46:53.417134 2026] [:error] [pid 57703:tid 58034] [client 158.158.111.117:61515] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13ede.php"] [unique_id "acK__fIVQxDtjkklWGZQrwAAAE8"]
[Wed Mar 25 00:46:53.984494 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:60236] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13ede.php"] [unique_id "acK__fIVQxDtjkklWGZQtQAAAFg"]
[Wed Mar 25 00:46:54.486566 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:60959] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acK__vIVQxDtjkklWGZQugAAAEo"]
[Wed Mar 25 00:46:55.058162 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:59118] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acK___IVQxDtjkklWGZQvgAAAEQ"]
[Wed Mar 25 00:46:55.595552 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:61571] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acK__w0pGUh6bwD3ouKDLAAAAMw"]
[Wed Mar 25 00:46:56.079513 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:57698] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/maul.php"] [unique_id "acLAAA0pGUh6bwD3ouKDLwAAAMA"]
[Wed Mar 25 00:46:56.582841 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:60978] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lopst.php"] [unique_id "acLAAA0pGUh6bwD3ouKDMwAAAMU"]
[Wed Mar 25 00:46:57.134676 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:60248] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lopst.php"] [unique_id "acLAAaS8TU_xcQFvlnb56wAAABc"]
[Wed Mar 25 00:46:57.780666 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:60330] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lopst.php"] [unique_id "acLAAaS8TU_xcQFvlnb57wAAAAU"]
[Wed Mar 25 00:46:58.296403 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:60344] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lopst.php"] [unique_id "acLAAg0pGUh6bwD3ouKDOAAAANg"]
[Wed Mar 25 00:46:58.830689 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:60297] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x23.php"] [unique_id "acLAAvIVQxDtjkklWGZQxwAAAEA"]
[Wed Mar 25 00:46:59.333039 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:59124] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x23.php"] [unique_id "acLAA6LdPFdeRRktTdNRCAAAAI4"]
[Wed Mar 25 00:46:59.856687 2026] [:error] [pid 57703:tid 58034] [client 158.158.111.117:60905] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x23.php"] [unique_id "acLAA_IVQxDtjkklWGZQyQAAAE8"]
[Wed Mar 25 00:47:00.384121 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:58192] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x23.php"] [unique_id "acLABPIVQxDtjkklWGZQzAAAAEc"]
[Wed Mar 25 00:47:00.973842 2026] [:error] [pid 57703:tid 58021] [client 158.158.111.117:61616] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gv.php"] [unique_id "acLABPIVQxDtjkklWGZQzwAAAEI"]
[Wed Mar 25 00:47:01.567135 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:60920] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gv.php"] [unique_id "acLABaLdPFdeRRktTdNRCwAAAJQ"]
[Wed Mar 25 00:47:02.095509 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:60254] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gv.php"] [unique_id "acLABvIVQxDtjkklWGZQ0gAAAEM"]
[Wed Mar 25 00:47:02.700327 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:59706] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gv.php"] [unique_id "acLABg0pGUh6bwD3ouKDRwAAAMk"]
[Wed Mar 25 00:47:03.365924 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:61547] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acLABw0pGUh6bwD3ouKDSwAAAMQ"]
[Wed Mar 25 00:47:04.173897 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60933] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acLACA0pGUh6bwD3ouKDVAAAAMY"]
[Wed Mar 25 00:47:05.683044 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:61533] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acLACaS8TU_xcQFvlnb5-AAAABc"]
[Wed Mar 25 00:47:10.414079 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60951] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acLADg0pGUh6bwD3ouKDZwAAAMc"]
[Wed Mar 25 00:47:53.981283 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:58232] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/alfa.php"] [unique_id "acLAOeb25OL4yTv2fF9o-AAAAQk"]
[Wed Mar 25 00:48:07.631055 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:60894] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clss.php"] [unique_id "acLAR6S8TU_xcQFvlnb6HwAAABg"]
[Wed Mar 25 00:48:08.176703 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:60929] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clss.php"] [unique_id "acLASKLdPFdeRRktTdNRIAAAAJQ"]
[Wed Mar 25 00:48:08.689649 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:61510] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clss.php"] [unique_id "acLASA0pGUh6bwD3ouKDkwAAAMk"]
[Wed Mar 25 00:48:09.244731 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:59115] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/clss.php"] [unique_id "acLASeb25OL4yTv2fF9pNgAAARg"]
[Wed Mar 25 00:48:09.883146 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:60306] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3n0m.php"] [unique_id "acLASeb25OL4yTv2fF9pOAAAAQ0"]
[Wed Mar 25 00:48:10.423460 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:60928] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3n0m.php"] [unique_id "acLASub25OL4yTv2fF9pOQAAAQ4"]
[Wed Mar 25 00:48:11.118411 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:60875] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3n0m.php"] [unique_id "acLAS-b25OL4yTv2fF9pOwAAARQ"]
[Wed Mar 25 00:48:11.611815 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:60966] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3n0m.php"] [unique_id "acLAS-b25OL4yTv2fF9pPQAAARE"]
[Wed Mar 25 00:48:12.187635 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:60983] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hbyra.php"] [unique_id "acLATOb25OL4yTv2fF9pQAAAAQM"]
[Wed Mar 25 00:48:12.696822 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:59712] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hbyra.php"] [unique_id "acLATKLdPFdeRRktTdNRJAAAAII"]
[Wed Mar 25 00:48:13.259943 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:58162] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hbyra.php"] [unique_id "acLATQ0pGUh6bwD3ouKDlwAAAMA"]
[Wed Mar 25 00:48:13.824038 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:57699] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hbyra.php"] [unique_id "acLATaLdPFdeRRktTdNRJQAAAIo"]
[Wed Mar 25 00:48:14.326512 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60932] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/my1.php"] [unique_id "acLATub25OL4yTv2fF9pQgAAARY"]
[Wed Mar 25 00:48:14.901528 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:57605] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/my1.php"] [unique_id "acLATub25OL4yTv2fF9pQwAAAQU"]
[Wed Mar 25 00:48:15.453540 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:60919] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/my1.php"] [unique_id "acLATw0pGUh6bwD3ouKDmAAAAMo"]
[Wed Mar 25 00:48:16.038777 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60952] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/my1.php"] [unique_id "acLAUA0pGUh6bwD3ouKDmQAAAM8"]
[Wed Mar 25 00:48:16.731162 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:60277] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bbn.php"] [unique_id "acLAUKS8TU_xcQFvlnb6IAAAAAY"]
[Wed Mar 25 00:48:17.383170 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60874] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bbn.php"] [unique_id "acLAUeb25OL4yTv2fF9pSQAAAQ8"]
[Wed Mar 25 00:48:17.978349 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:60322] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bbn.php"] [unique_id "acLAUQ0pGUh6bwD3ouKDnAAAANM"]
[Wed Mar 25 00:48:18.578469 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60879] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bbn.php"] [unique_id "acLAUg0pGUh6bwD3ouKDnQAAANc"]
[Wed Mar 25 00:48:19.070829 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:61631] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfile.php"] [unique_id "acLAUw0pGUh6bwD3ouKDngAAAME"]
[Wed Mar 25 00:48:19.832202 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:59769] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfile.php"] [unique_id "acLAU-b25OL4yTv2fF9pTgAAARQ"]
[Wed Mar 25 00:48:20.344917 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:59729] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfile.php"] [unique_id "acLAVKS8TU_xcQFvlnb6IgAAAA8"]
[Wed Mar 25 00:48:21.013946 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:59761] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfile.php"] [unique_id "acLAVaLdPFdeRRktTdNRKQAAAJA"]
[Wed Mar 25 00:48:21.507879 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:60249] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file66.php"] [unique_id "acLAVaLdPFdeRRktTdNRKwAAAJI"]
[Wed Mar 25 00:48:22.224945 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60903] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file66.php"] [unique_id "acLAVg0pGUh6bwD3ouKDoQAAAMg"]
[Wed Mar 25 00:48:22.704649 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:61581] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file66.php"] [unique_id "acLAVg0pGUh6bwD3ouKDowAAAMY"]
[Wed Mar 25 00:48:23.199111 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:60980] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file66.php"] [unique_id "acLAV6LdPFdeRRktTdNRLAAAAI8"]
[Wed Mar 25 00:48:23.755253 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:60893] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/c.php"] [unique_id "acLAV-b25OL4yTv2fF9pUgAAAQg"]
[Wed Mar 25 00:48:24.445666 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:59754] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/c.php"] [unique_id "acLAWKS8TU_xcQFvlnb6JQAAABA"]
[Wed Mar 25 00:48:25.023877 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:61539] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/c.php"] [unique_id "acLAWaS8TU_xcQFvlnb6JgAAAA4"]
[Wed Mar 25 00:48:25.578281 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:60348] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/c.php"] [unique_id "acLAWaS8TU_xcQFvlnb6JwAAABM"]
[Wed Mar 25 00:48:26.211445 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:61612] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "acLAWg0pGUh6bwD3ouKDpQAAAMI"]
[Wed Mar 25 00:48:26.691039 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:60908] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "acLAWub25OL4yTv2fF9pWQAAARQ"]
[Wed Mar 25 00:48:27.199437 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:60918] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "acLAWw0pGUh6bwD3ouKDpgAAANE"]
[Wed Mar 25 00:48:28.261498 2026] [:error] [pid 57702:tid 57915] [client 158.158.111.117:61603] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doc.php"] [unique_id "acLAXKS8TU_xcQFvlnb6LQAAAAw"]
[Wed Mar 25 00:48:28.777836 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:61524] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acLAXOb25OL4yTv2fF9pXQAAARE"]
[Wed Mar 25 00:48:29.426833 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:60916] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acLAXaLdPFdeRRktTdNRNAAAAJc"]
[Wed Mar 25 00:48:29.941581 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:61512] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acLAXaLdPFdeRRktTdNRNgAAAIQ"]
[Wed Mar 25 00:48:30.842168 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:61545] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acLAXvIVQxDtjkklWGZQ3gAAAFE"]
[Wed Mar 25 00:48:31.447412 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:61530] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpssl.php"] [unique_id "acLAX-b25OL4yTv2fF9pYgAAAQg"]
[Wed Mar 25 00:48:32.165226 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:61629] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpssl.php"] [unique_id "acLAYOb25OL4yTv2fF9pZAAAARM"]
[Wed Mar 25 00:48:32.654512 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:60881] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpssl.php"] [unique_id "acLAYA0pGUh6bwD3ouKDsAAAAM4"]
[Wed Mar 25 00:48:33.163625 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60957] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpssl.php"] [unique_id "acLAYQ0pGUh6bwD3ouKDsgAAAME"]
[Wed Mar 25 00:48:33.697370 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:60934] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wps.php"] [unique_id "acLAYeb25OL4yTv2fF9pZgAAAQk"]
[Wed Mar 25 00:48:34.323715 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:59664] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wps.php"] [unique_id "acLAYg0pGUh6bwD3ouKDuQAAAMk"]
[Wed Mar 25 00:48:34.827157 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:61585] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wps.php"] [unique_id "acLAYg0pGUh6bwD3ouKDvQAAAMQ"]
[Wed Mar 25 00:48:35.309732 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:58194] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wps.php"] [unique_id "acLAY6LdPFdeRRktTdNRNwAAAIk"]
[Wed Mar 25 00:48:35.868367 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:61549] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.php"] [unique_id "acLAYw0pGUh6bwD3ouKDwAAAAMU"]
[Wed Mar 25 00:48:36.359497 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:60331] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.php"] [unique_id "acLAZOb25OL4yTv2fF9pbAAAAQE"]
[Wed Mar 25 00:48:36.872437 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:61614] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.php"] [unique_id "acLAZOb25OL4yTv2fF9pbQAAARU"]
[Wed Mar 25 00:48:37.424936 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59052] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.php"] [unique_id "acLAZeb25OL4yTv2fF9pbgAAAQY"]
[Wed Mar 25 00:48:37.926895 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:60266] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asasx.php"] [unique_id "acLAZeb25OL4yTv2fF9pcAAAAQs"]
[Wed Mar 25 00:48:38.431820 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:60309] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asasx.php"] [unique_id "acLAZqLdPFdeRRktTdNROwAAAJI"]
[Wed Mar 25 00:48:38.963492 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59085] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asasx.php"] [unique_id "acLAZub25OL4yTv2fF9pcgAAAQc"]
[Wed Mar 25 00:48:39.569856 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:59687] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asasx.php"] [unique_id "acLAZ6LdPFdeRRktTdNRPAAAAIE"]
[Wed Mar 25 00:48:40.078834 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:60987] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwso.php"] [unique_id "acLAaKS8TU_xcQFvlnb6MQAAAAY"]
[Wed Mar 25 00:48:40.659875 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60927] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwso.php"] [unique_id "acLAaKS8TU_xcQFvlnb6MgAAABY"]
[Wed Mar 25 00:48:41.209143 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:60991] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwso.php"] [unique_id "acLAaaS8TU_xcQFvlnb6MwAAAA8"]
[Wed Mar 25 00:48:41.797381 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:59077] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zwso.php"] [unique_id "acLAaaS8TU_xcQFvlnb6NQAAABE"]
[Wed Mar 25 00:48:42.340078 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59084] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tqloh.php"] [unique_id "acLAaub25OL4yTv2fF9pegAAAQQ"]
[Wed Mar 25 00:48:42.909527 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:60343] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tqloh.php"] [unique_id "acLAaub25OL4yTv2fF9pfAAAAQI"]
[Wed Mar 25 00:48:43.560677 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:59738] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tqloh.php"] [unique_id "acLAa_IVQxDtjkklWGZQ5AAAAEc"]
[Wed Mar 25 00:48:44.125480 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:60347] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tqloh.php"] [unique_id "acLAbOb25OL4yTv2fF9pfQAAARg"]
[Wed Mar 25 00:48:44.681155 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:58122] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acLAbKS8TU_xcQFvlnb6OQAAAAQ"]
[Wed Mar 25 00:48:45.203864 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:58144] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acLAbeb25OL4yTv2fF9pfgAAARI"]
[Wed Mar 25 00:48:45.781150 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:60961] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acLAbeb25OL4yTv2fF9pgAAAAQE"]
[Wed Mar 25 00:48:46.298290 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:59713] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tt.php"] [unique_id "acLAbub25OL4yTv2fF9pggAAAQs"]
[Wed Mar 25 00:48:46.785448 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59671] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl9.php"] [unique_id "acLAbub25OL4yTv2fF9phQAAAQc"]
[Wed Mar 25 00:48:47.291820 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:60337] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl9.php"] [unique_id "acLAb6LdPFdeRRktTdNRPgAAAIU"]
[Wed Mar 25 00:48:47.816305 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:61554] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl9.php"] [unique_id "acLAb6LdPFdeRRktTdNRPwAAAJQ"]
[Wed Mar 25 00:48:48.359072 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:60953] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl9.php"] [unique_id "acLAcKS8TU_xcQFvlnb6PgAAABQ"]
[Wed Mar 25 00:48:48.849159 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:61513] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acwfihfh.php"] [unique_id "acLAcOb25OL4yTv2fF9piAAAARM"]
[Wed Mar 25 00:48:49.448786 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:60281] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acwfihfh.php"] [unique_id "acLAcfIVQxDtjkklWGZQ6QAAAEo"]
[Wed Mar 25 00:48:49.995837 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:58149] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acwfihfh.php"] [unique_id "acLAceb25OL4yTv2fF9piwAAAQk"]
[Wed Mar 25 00:48:50.591126 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59743] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acwfihfh.php"] [unique_id "acLAcub25OL4yTv2fF9pjQAAAQo"]
[Wed Mar 25 00:48:51.126527 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60321] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acLAc-b25OL4yTv2fF9pjwAAARY"]
[Wed Mar 25 00:48:51.657791 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:60231] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acLAc6S8TU_xcQFvlnb6QgAAABg"]
[Wed Mar 25 00:48:52.209994 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60324] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acLAdOb25OL4yTv2fF9plAAAAQA"]
[Wed Mar 25 00:48:52.781652 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:59110] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acLAdKLdPFdeRRktTdNRQwAAAIA"]
[Wed Mar 25 00:48:53.320546 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:59074] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ana.php"] [unique_id "acLAdeb25OL4yTv2fF9plgAAARE"]
[Wed Mar 25 00:48:53.825093 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60963] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ana.php"] [unique_id "acLAdaS8TU_xcQFvlnb6RAAAAAM"]
[Wed Mar 25 00:48:54.366565 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:61543] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ana.php"] [unique_id "acLAdqS8TU_xcQFvlnb6RwAAABY"]
[Wed Mar 25 00:48:54.882166 2026] [:error] [pid 57702:tid 57926] [client 158.158.111.117:59765] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ana.php"] [unique_id "acLAdqS8TU_xcQFvlnb6SAAAABc"]
[Wed Mar 25 00:48:55.419979 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:59127] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-securitiy.php"] [unique_id "acLAd6LdPFdeRRktTdNRRwAAAJY"]
[Wed Mar 25 00:48:55.902723 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:59066] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-securitiy.php"] [unique_id "acLAd6LdPFdeRRktTdNRSgAAAJA"]
[Wed Mar 25 00:48:56.454955 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:59720] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-securitiy.php"] [unique_id "acLAeKLdPFdeRRktTdNRSwAAAI4"]
[Wed Mar 25 00:48:56.969180 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:60285] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-securitiy.php"] [unique_id "acLAeOb25OL4yTv2fF9pnQAAARQ"]
[Wed Mar 25 00:48:57.511498 2026] [:error] [pid 57703:tid 58039] [client 158.158.111.117:59766] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pass.php"] [unique_id "acLAefIVQxDtjkklWGZQ7AAAAFQ"]
[Wed Mar 25 00:48:58.082407 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59771] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pass.php"] [unique_id "acLAeub25OL4yTv2fF9pnwAAAQo"]
[Wed Mar 25 00:48:58.667664 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:59106] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pass.php"] [unique_id "acLAeqLdPFdeRRktTdNRTAAAAJg"]
[Wed Mar 25 00:48:59.166369 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:59073] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pass.php"] [unique_id "acLAe-b25OL4yTv2fF9ppAAAAQE"]
[Wed Mar 25 00:48:59.651618 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:59745] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "acLAe6LdPFdeRRktTdNRTQAAAJI"]
[Wed Mar 25 00:49:00.289496 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:58117] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "acLAfOb25OL4yTv2fF9ppgAAARE"]
[Wed Mar 25 00:49:00.791150 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:59022] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "acLAfOb25OL4yTv2fF9pqQAAAQ0"]
[Wed Mar 25 00:49:01.354992 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60303] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/readme.php"] [unique_id "acLAfeb25OL4yTv2fF9pqwAAAQ8"]
[Wed Mar 25 00:49:01.855945 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:61596] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/txets.php"] [unique_id "acLAfeb25OL4yTv2fF9prwAAARQ"]
[Wed Mar 25 00:49:02.404774 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60955] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/txets.php"] [unique_id "acLAfub25OL4yTv2fF9psAAAAQc"]
[Wed Mar 25 00:49:02.899491 2026] [:error] [pid 57702:tid 57915] [client 158.158.111.117:60937] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/txets.php"] [unique_id "acLAfqS8TU_xcQFvlnb6TgAAAAw"]
[Wed Mar 25 00:49:03.474289 2026] [:error] [pid 57702:tid 57913] [client 158.158.111.117:60288] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/txets.php"] [unique_id "acLAf6S8TU_xcQFvlnb6UAAAAAo"]
[Wed Mar 25 00:49:04.057950 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:57617] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qqq.php"] [unique_id "acLAgKLdPFdeRRktTdNRVgAAAJM"]
[Wed Mar 25 00:49:04.638514 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:60232] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qqq.php"] [unique_id "acLAgKS8TU_xcQFvlnb6VAAAAAY"]
[Wed Mar 25 00:49:05.133591 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60909] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qqq.php"] [unique_id "acLAgaS8TU_xcQFvlnb6VgAAAAs"]
[Wed Mar 25 00:49:05.720802 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:60895] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qqq.php"] [unique_id "acLAgeb25OL4yTv2fF9pswAAARc"]
[Wed Mar 25 00:49:22.871620 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:59101] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ha.php"] [unique_id "acLAkub25OL4yTv2fF9p9QAAARY"]
[Wed Mar 25 00:49:23.373855 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:59721] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ha.php"] [unique_id "acLAkw0pGUh6bwD3ouKDyQAAANY"]
[Wed Mar 25 00:49:23.865490 2026] [:error] [pid 57703:tid 58039] [client 158.158.111.117:61538] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ha.php"] [unique_id "acLAk_IVQxDtjkklWGZQ_wAAAFQ"]
[Wed Mar 25 00:49:24.416904 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:60226] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ha.php"] [unique_id "acLAlPIVQxDtjkklWGZRAAAAAEM"]
[Wed Mar 25 00:49:25.209179 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:59119] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "acLAleb25OL4yTv2fF9p_wAAAQA"]
[Wed Mar 25 00:49:25.777335 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:58202] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cjfuns.php"] [unique_id "acLAleb25OL4yTv2fF9qAgAAARI"]
[Wed Mar 25 00:49:26.441097 2026] [:error] [pid 20371:tid 20385] [client 158.158.111.117:60984] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cjfuns.php"] [unique_id "acLAlub25OL4yTv2fF9qBAAAAQw"]
[Wed Mar 25 00:49:26.980326 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:61567] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cjfuns.php"] [unique_id "acLAlqLdPFdeRRktTdNRdAAAAI8"]
[Wed Mar 25 00:49:27.685472 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:60271] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cjfuns.php"] [unique_id "acLAl-b25OL4yTv2fF9qBQAAAQU"]
[Wed Mar 25 00:49:28.434273 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:59042] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "acLAmOb25OL4yTv2fF9qBwAAAQg"]
[Wed Mar 25 00:49:29.007091 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:60300] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "acLAmeb25OL4yTv2fF9qCgAAARg"]
[Wed Mar 25 00:49:29.572466 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:61573] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "acLAmQ0pGUh6bwD3ouKDywAAANE"]
[Wed Mar 25 00:49:30.818271 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:60258] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cong.php"] [unique_id "acLAmvIVQxDtjkklWGZRAwAAAEA"]
[Wed Mar 25 00:49:31.315955 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60242] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xpw.php"] [unique_id "acLAmw0pGUh6bwD3ouKDzwAAAM8"]
[Wed Mar 25 00:49:31.843354 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59718] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xpw.php"] [unique_id "acLAmw0pGUh6bwD3ouKD1AAAANc"]
[Wed Mar 25 00:49:32.476380 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:60224] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xpw.php"] [unique_id "acLAnPIVQxDtjkklWGZRBQAAAEQ"]
[Wed Mar 25 00:49:33.125545 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:59064] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xpw.php"] [unique_id "acLAneb25OL4yTv2fF9qDgAAAQs"]
[Wed Mar 25 00:49:33.729849 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60911] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pop.php"] [unique_id "acLAnQ0pGUh6bwD3ouKD2QAAAMY"]
[Wed Mar 25 00:49:34.266250 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:57620] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pop.php"] [unique_id "acLAnqS8TU_xcQFvlnb6ZgAAAAQ"]
[Wed Mar 25 00:49:34.858499 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:59030] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pop.php"] [unique_id "acLAnqLdPFdeRRktTdNRdgAAAIU"]
[Wed Mar 25 00:49:35.460439 2026] [:error] [pid 57703:tid 58024] [client 158.158.111.117:59753] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pop.php"] [unique_id "acLAn_IVQxDtjkklWGZRBgAAAEU"]
[Wed Mar 25 00:49:36.080291 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59760] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/moto.php"] [unique_id "acLAoA0pGUh6bwD3ouKD4gAAANc"]
[Wed Mar 25 00:49:36.591396 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60974] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/moto.php"] [unique_id "acLAoA0pGUh6bwD3ouKD4wAAANA"]
[Wed Mar 25 00:49:37.103737 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:59728] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/moto.php"] [unique_id "acLAoQ0pGUh6bwD3ouKD5AAAAMY"]
[Wed Mar 25 00:49:37.730470 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59730] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/moto.php"] [unique_id "acLAoQ0pGUh6bwD3ouKD5QAAAMM"]
[Wed Mar 25 00:49:38.297368 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60982] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acLAog0pGUh6bwD3ouKD6QAAAMk"]
[Wed Mar 25 00:49:38.842952 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:60931] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acLAoub25OL4yTv2fF9qEwAAAQg"]
[Wed Mar 25 00:49:39.334085 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60290] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acLAow0pGUh6bwD3ouKD6wAAANc"]
[Wed Mar 25 00:49:39.909447 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:60241] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acLAo-b25OL4yTv2fF9qFwAAAQo"]
[Wed Mar 25 00:49:40.649079 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:59120] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/zwso.php"] [unique_id "acLApOb25OL4yTv2fF9qGQAAAQE"]
[Wed Mar 25 00:49:41.285671 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59010] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/zwso.php"] [unique_id "acLApeb25OL4yTv2fF9qHAAAAQQ"]
[Wed Mar 25 00:49:41.867593 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:60981] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/zwso.php"] [unique_id "acLApeb25OL4yTv2fF9qHQAAAQk"]
[Wed Mar 25 00:49:42.596852 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:57628] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/zwso.php"] [unique_id "acLApqLdPFdeRRktTdNReQAAAIQ"]
[Wed Mar 25 00:49:43.155696 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:59651] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx9.php"] [unique_id "acLApw0pGUh6bwD3ouKD7wAAAMc"]
[Wed Mar 25 00:49:43.657598 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60907] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx9.php"] [unique_id "acLApw0pGUh6bwD3ouKD8AAAANI"]
[Wed Mar 25 00:49:44.176451 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:60913] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx9.php"] [unique_id "acLAqA0pGUh6bwD3ouKD8QAAANQ"]
[Wed Mar 25 00:49:44.681382 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60280] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx9.php"] [unique_id "acLAqKLdPFdeRRktTdNRewAAAII"]
[Wed Mar 25 00:49:45.185753 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:61551] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLAqaLdPFdeRRktTdNRfAAAAIA"]
[Wed Mar 25 00:49:45.911808 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:59062] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLAqfIVQxDtjkklWGZRCwAAAEo"]
[Wed Mar 25 00:49:46.488359 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:58154] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLAqvIVQxDtjkklWGZRDAAAAFU"]
[Wed Mar 25 00:49:47.060536 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:60264] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLAq6S8TU_xcQFvlnb6bQAAABQ"]
[Wed Mar 25 00:49:47.592912 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:61587] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x1949.php"] [unique_id "acLAq6LdPFdeRRktTdNRfgAAAIk"]
[Wed Mar 25 00:49:47.943605 2026] [:error] [pid 57711:tid 58076] [client 159.65.167.144:58684] [client 159.65.167.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "acLAq6LdPFdeRRktTdNRfwAAAJY"]
[Wed Mar 25 00:49:48.095413 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:60950] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x1949.php"] [unique_id "acLArOb25OL4yTv2fF9qHwAAARE"]
[Wed Mar 25 00:49:48.621084 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:60227] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x1949.php"] [unique_id "acLArKLdPFdeRRktTdNRgAAAAJA"]
[Wed Mar 25 00:49:49.220190 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:57664] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x1949.php"] [unique_id "acLArQ0pGUh6bwD3ouKD9QAAAMg"]
[Wed Mar 25 00:49:49.795978 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:60327] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mails.php"] [unique_id "acLAraLdPFdeRRktTdNRggAAAJg"]
[Wed Mar 25 00:49:50.338592 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:61580] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mails.php"] [unique_id "acLArg0pGUh6bwD3ouKD9gAAAMA"]
[Wed Mar 25 00:49:50.892003 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59653] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mails.php"] [unique_id "acLArqS8TU_xcQFvlnb6bgAAABg"]
[Wed Mar 25 00:49:51.537523 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:59111] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mails.php"] [unique_id "acLAr6S8TU_xcQFvlnb6bwAAAAY"]
[Wed Mar 25 00:49:52.058409 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60876] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1vbqo.php"] [unique_id "acLAsKS8TU_xcQFvlnb6cQAAAAs"]
[Wed Mar 25 00:49:52.659033 2026] [:error] [pid 57702:tid 57916] [client 158.158.111.117:59018] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1vbqo.php"] [unique_id "acLAsKS8TU_xcQFvlnb6cgAAAA0"]
[Wed Mar 25 00:49:53.181146 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:59104] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1vbqo.php"] [unique_id "acLAsaS8TU_xcQFvlnb6cwAAABE"]
[Wed Mar 25 00:49:53.775783 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:55748] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1vbqo.php"] [unique_id "acLAsaS8TU_xcQFvlnb6dgAAAAQ"]
[Wed Mar 25 00:49:54.399282 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:59680] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/monso.php"] [unique_id "acLAsqS8TU_xcQFvlnb6dwAAABI"]
[Wed Mar 25 00:49:54.922802 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:58153] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/monso.php"] [unique_id "acLAsg0pGUh6bwD3ouKD-wAAAMY"]
[Wed Mar 25 00:49:55.586811 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:58156] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/monso.php"] [unique_id "acLAs6S8TU_xcQFvlnb6eQAAAAc"]
[Wed Mar 25 00:49:56.163229 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60257] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/monso.php"] [unique_id "acLAtA0pGUh6bwD3ouKD_wAAAMc"]
[Wed Mar 25 00:49:56.663435 2026] [:error] [pid 57703:tid 58025] [client 158.158.111.117:59061] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hq.php"] [unique_id "acLAtPIVQxDtjkklWGZRFwAAAEY"]
[Wed Mar 25 00:50:14.215492 2026] [:error] [pid 57711:tid 58060] [client 158.158.111.117:60941] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "acLAxqLdPFdeRRktTdNRkQAAAIg"]
[Wed Mar 25 00:50:15.032498 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:61589] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-eux6r.php"] [unique_id "acLAx-b25OL4yTv2fF9qSAAAAQU"]
[Wed Mar 25 00:50:15.884509 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60238] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-eux6r.php"] [unique_id "acLAxw0pGUh6bwD3ouKELgAAAMc"]
[Wed Mar 25 00:50:16.408974 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:61570] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-eux6r.php"] [unique_id "acLAyA0pGUh6bwD3ouKELwAAAMM"]
[Wed Mar 25 00:50:16.982003 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:60917] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-eux6r.php"] [unique_id "acLAyOb25OL4yTv2fF9qSwAAAQE"]
[Wed Mar 25 00:50:17.630269 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:59083] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pwyjwrfr.php"] [unique_id "acLAyQ0pGUh6bwD3ouKEMQAAAMs"]
[Wed Mar 25 00:50:18.193162 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60310] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pwyjwrfr.php"] [unique_id "acLAyg0pGUh6bwD3ouKEMgAAANI"]
[Wed Mar 25 00:50:18.737629 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:59723] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pwyjwrfr.php"] [unique_id "acLAyg0pGUh6bwD3ouKENQAAAMo"]
[Wed Mar 25 00:50:19.279391 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:60989] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/pwyjwrfr.php"] [unique_id "acLAy-b25OL4yTv2fF9qTAAAARg"]
[Wed Mar 25 00:50:19.761721 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:57689] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indexs.php"] [unique_id "acLAy-b25OL4yTv2fF9qTgAAAQI"]
[Wed Mar 25 00:50:20.306406 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:61594] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indexs.php"] [unique_id "acLAzKS8TU_xcQFvlnb6gQAAABE"]
[Wed Mar 25 00:50:20.874549 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:57649] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/indexs.php"] [unique_id "acLAzOb25OL4yTv2fF9qUAAAARI"]
[Wed Mar 25 00:50:36.642997 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60278] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ma.php"] [unique_id "acLA3A0pGUh6bwD3ouKEWwAAANI"]
[Wed Mar 25 00:50:37.179006 2026] [:error] [pid 57703:tid 58028] [client 158.158.111.117:60938] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ma.php"] [unique_id "acLA3fIVQxDtjkklWGZRMwAAAEk"]
[Wed Mar 25 00:50:37.819441 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:60225] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ma.php"] [unique_id "acLA3aS8TU_xcQFvlnb6mAAAAAE"]
[Wed Mar 25 00:50:38.353689 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60326] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ma.php"] [unique_id "acLA3ub25OL4yTv2fF9qawAAARI"]
[Wed Mar 25 00:50:38.879048 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:61537] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doelr.php"] [unique_id "acLA3g0pGUh6bwD3ouKEXwAAAMQ"]
[Wed Mar 25 00:50:39.454645 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:57600] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doelr.php"] [unique_id "acLA3-b25OL4yTv2fF9qbQAAAQU"]
[Wed Mar 25 00:50:39.990613 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:61611] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doelr.php"] [unique_id "acLA36S8TU_xcQFvlnb6nAAAAAM"]
[Wed Mar 25 00:50:40.489371 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:61615] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doelr.php"] [unique_id "acLA4Ob25OL4yTv2fF9qbgAAARY"]
[Wed Mar 25 00:50:40.999130 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:61606] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gecko.php"] [unique_id "acLA4Ob25OL4yTv2fF9qcAAAARE"]
[Wed Mar 25 00:50:41.595418 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60244] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gecko.php"] [unique_id "acLA4Q0pGUh6bwD3ouKEYgAAAME"]
[Wed Mar 25 00:50:42.233203 2026] [:error] [pid 57703:tid 58039] [client 158.158.111.117:60340] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gecko.php"] [unique_id "acLA4vIVQxDtjkklWGZRNAAAAFQ"]
[Wed Mar 25 00:50:42.936303 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60956] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gecko.php"] [unique_id "acLA4qLdPFdeRRktTdNRmAAAAII"]
[Wed Mar 25 00:50:43.451314 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:59732] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/delete3.php"] [unique_id "acLA4-b25OL4yTv2fF9qeQAAARM"]
[Wed Mar 25 00:50:43.981231 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:61578] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/delete3.php"] [unique_id "acLA4w0pGUh6bwD3ouKEZAAAAMM"]
[Wed Mar 25 00:50:44.481747 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:59774] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/delete3.php"] [unique_id "acLA5Ob25OL4yTv2fF9qfQAAAQA"]
[Wed Mar 25 00:50:44.983408 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:57623] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/delete3.php"] [unique_id "acLA5Ob25OL4yTv2fF9qgAAAAQU"]
[Wed Mar 25 00:50:45.499483 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:61576] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest4.php"] [unique_id "acLA5aS8TU_xcQFvlnb6nQAAAAs"]
[Wed Mar 25 00:50:46.209422 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:61621] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest4.php"] [unique_id "acLA5qS8TU_xcQFvlnb6nwAAABA"]
[Wed Mar 25 00:50:46.725664 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:59740] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest4.php"] [unique_id "acLA5ub25OL4yTv2fF9qgwAAARU"]
[Wed Mar 25 00:50:47.298315 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:60250] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jatest4.php"] [unique_id "acLA5w0pGUh6bwD3ouKEbQAAAMo"]
[Wed Mar 25 00:50:47.858222 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:55718] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin-header.php"] [unique_id "acLA5-b25OL4yTv2fF9qhgAAAQE"]
[Wed Mar 25 00:50:48.711978 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:60308] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin-header.php"] [unique_id "acLA6PIVQxDtjkklWGZROAAAAEw"]
[Wed Mar 25 00:50:49.232910 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:60235] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin-header.php"] [unique_id "acLA6fIVQxDtjkklWGZROQAAAFg"]
[Wed Mar 25 00:50:49.806708 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:60234] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin-header.php"] [unique_id "acLA6aLdPFdeRRktTdNRmwAAAJY"]
[Wed Mar 25 00:50:50.374498 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:58182] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/about.php"] [unique_id "acLA6vIVQxDtjkklWGZROgAAAFI"]
[Wed Mar 25 00:50:51.063645 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60948] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/about.php"] [unique_id "acLA6-b25OL4yTv2fF9qiwAAARY"]
[Wed Mar 25 00:50:51.672755 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:59742] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/about.php"] [unique_id "acLA6w0pGUh6bwD3ouKEfAAAAM8"]
[Wed Mar 25 00:50:52.230595 2026] [:error] [pid 57711:tid 58060] [client 158.158.111.117:59714] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/about.php"] [unique_id "acLA7KLdPFdeRRktTdNRnQAAAIg"]
[Wed Mar 25 00:50:52.781191 2026] [:error] [pid 57702:tid 57904] [client 158.158.111.117:61577] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/22c.php"] [unique_id "acLA7KS8TU_xcQFvlnb6qAAAAAE"]
[Wed Mar 25 00:50:53.413213 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:60272] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/22c.php"] [unique_id "acLA7aS8TU_xcQFvlnb6qgAAAA8"]
[Wed Mar 25 00:50:54.018961 2026] [:error] [pid 57711:tid 58054] [client 158.158.111.117:60866] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/22c.php"] [unique_id "acLA7qLdPFdeRRktTdNRoAAAAIM"]
[Wed Mar 25 00:50:54.578216 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:61586] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/22c.php"] [unique_id "acLA7g0pGUh6bwD3ouKEgAAAAME"]
[Wed Mar 25 00:50:55.198507 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:58158] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/batm.php"] [unique_id "acLA7w0pGUh6bwD3ouKEgQAAAMI"]
[Wed Mar 25 00:50:55.810263 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:59658] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/batm.php"] [unique_id "acLA7w0pGUh6bwD3ouKEhAAAAMs"]
[Wed Mar 25 00:50:56.319970 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:59123] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/batm.php"] [unique_id "acLA8Ob25OL4yTv2fF9qjwAAARQ"]
[Wed Mar 25 00:50:56.885118 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:60869] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/batm.php"] [unique_id "acLA8KS8TU_xcQFvlnb6rwAAAAI"]
[Wed Mar 25 00:50:57.456294 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:60291] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/halo.php"] [unique_id "acLA8eb25OL4yTv2fF9qkwAAAQo"]
[Wed Mar 25 00:50:58.156370 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59731] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/halo.php"] [unique_id "acLA8g0pGUh6bwD3ouKEiQAAANE"]
[Wed Mar 25 00:50:58.785934 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60311] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/halo.php"] [unique_id "acLA8g0pGUh6bwD3ouKEjAAAAMg"]
[Wed Mar 25 00:50:59.348748 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60943] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/halo.php"] [unique_id "acLA8w0pGUh6bwD3ouKEjgAAAMA"]
[Wed Mar 25 00:50:59.904221 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:60295] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1aa.php"] [unique_id "acLA8-b25OL4yTv2fF9qogAAARQ"]
[Wed Mar 25 00:51:00.550094 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60253] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1aa.php"] [unique_id "acLA9A0pGUh6bwD3ouKEjwAAAMc"]
[Wed Mar 25 00:51:01.449711 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60286] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1aa.php"] [unique_id "acLA9eb25OL4yTv2fF9qrQAAAQA"]
[Wed Mar 25 00:51:02.005054 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60888] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1aa.php"] [unique_id "acLA9ub25OL4yTv2fF9qsgAAARY"]
[Wed Mar 25 00:51:02.617640 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:59736] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/M1.php"] [unique_id "acLA9qLdPFdeRRktTdNRpwAAAIY"]
[Wed Mar 25 00:51:03.151096 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59697] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/M1.php"] [unique_id "acLA9w0pGUh6bwD3ouKEkQAAAMI"]
[Wed Mar 25 00:51:03.679273 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:61626] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/M1.php"] [unique_id "acLA96LdPFdeRRktTdNRqQAAAI0"]
[Wed Mar 25 00:51:04.231231 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60971] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/M1.php"] [unique_id "acLA-A0pGUh6bwD3ouKElQAAANY"]
[Wed Mar 25 00:51:04.759731 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:58223] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/family.php"] [unique_id "acLA-A0pGUh6bwD3ouKEmgAAAMQ"]
[Wed Mar 25 00:51:05.427194 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60877] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/family.php"] [unique_id "acLA-Q0pGUh6bwD3ouKEoQAAANY"]
[Wed Mar 25 00:51:05.933205 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:59684] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/family.php"] [unique_id "acLA-aS8TU_xcQFvlnb6uAAAAA4"]
[Wed Mar 25 00:51:06.460093 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59752] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/family.php"] [unique_id "acLA-ub25OL4yTv2fF9qtwAAAQQ"]
[Wed Mar 25 00:51:07.087917 2026] [:error] [pid 57702:tid 57913] [client 158.158.111.117:59050] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media.php"] [unique_id "acLA-6S8TU_xcQFvlnb6vAAAAAo"]
[Wed Mar 25 00:51:07.618083 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:60923] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media.php"] [unique_id "acLA-6S8TU_xcQFvlnb6vQAAAAk"]
[Wed Mar 25 00:51:08.219953 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:61546] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media.php"] [unique_id "acLA_KS8TU_xcQFvlnb6vgAAABQ"]
[Wed Mar 25 00:51:08.750479 2026] [:error] [pid 57703:tid 58042] [client 158.158.111.117:61557] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media.php"] [unique_id "acLA_PIVQxDtjkklWGZRQQAAAFc"]
[Wed Mar 25 00:51:09.419382 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:61561] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsz.php"] [unique_id "acLA_aLdPFdeRRktTdNRqwAAAJY"]
[Wed Mar 25 00:51:10.235377 2026] [:error] [pid 57703:tid 58021] [client 158.158.111.117:61506] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsz.php"] [unique_id "acLA_vIVQxDtjkklWGZRRAAAAEI"]
[Wed Mar 25 00:51:10.934421 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:57690] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsz.php"] [unique_id "acLA_ub25OL4yTv2fF9qwQAAAQk"]
[Wed Mar 25 00:51:11.545076 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:60868] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsz.php"] [unique_id "acLA__IVQxDtjkklWGZRSgAAAFg"]
[Wed Mar 25 00:51:12.292565 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:58185] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chitchatback.php"] [unique_id "acLBAA0pGUh6bwD3ouKEsAAAANM"]
[Wed Mar 25 00:51:12.919984 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:60279] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chitchatback.php"] [unique_id "acLBAOb25OL4yTv2fF9qxQAAARA"]
[Wed Mar 25 00:51:13.801772 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:60920] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chitchatback.php"] [unique_id "acLBAeb25OL4yTv2fF9qyAAAAQg"]
[Wed Mar 25 00:51:14.417418 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:59048] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chitchatback.php"] [unique_id "acLBAub25OL4yTv2fF9qzAAAAQU"]
[Wed Mar 25 00:51:14.962524 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:59746] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1234.php"] [unique_id "acLBAg0pGUh6bwD3ouKEtQAAANQ"]
[Wed Mar 25 00:51:15.559493 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:59755] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1234.php"] [unique_id "acLBA6S8TU_xcQFvlnb6xQAAAAQ"]
[Wed Mar 25 00:51:16.091195 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:59715] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1234.php"] [unique_id "acLBBKS8TU_xcQFvlnb6xwAAAAg"]
[Wed Mar 25 00:51:16.697683 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:56890] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1234.php"] [unique_id "acLBBOb25OL4yTv2fF9q0QAAARM"]
[Wed Mar 25 00:51:17.257613 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59014] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/woh.php"] [unique_id "acLBBeb25OL4yTv2fF9q0wAAAQc"]
[Wed Mar 25 00:51:17.790308 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59129] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/woh.php"] [unique_id "acLBBeb25OL4yTv2fF9q2AAAAQY"]
[Wed Mar 25 00:51:18.366952 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:56409] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/woh.php"] [unique_id "acLBBub25OL4yTv2fF9q2wAAARc"]
[Wed Mar 25 00:51:18.911952 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59032] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/woh.php"] [unique_id "acLBBub25OL4yTv2fF9q3wAAAQQ"]
[Wed Mar 25 00:51:19.507057 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60891] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/i.php"] [unique_id "acLBBw0pGUh6bwD3ouKEuQAAAMA"]
[Wed Mar 25 00:51:20.035607 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:58206] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/i.php"] [unique_id "acLBCOb25OL4yTv2fF9q4wAAAQg"]
[Wed Mar 25 00:51:20.598502 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:60263] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/i.php"] [unique_id "acLBCOb25OL4yTv2fF9q5gAAAQY"]
[Wed Mar 25 00:51:21.173108 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:59722] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/i.php"] [unique_id "acLBCeb25OL4yTv2fF9q6gAAARA"]
[Wed Mar 25 00:51:21.731251 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:58192] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "acLBCeb25OL4yTv2fF9q7wAAAQ8"]
[Wed Mar 25 00:51:22.318166 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:61616] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "acLBCub25OL4yTv2fF9q9AAAAQU"]
[Wed Mar 25 00:51:23.103023 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:60229] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "acLBC-b25OL4yTv2fF9q-gAAAQ4"]
[Wed Mar 25 00:51:23.624969 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:61519] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "acLBC-b25OL4yTv2fF9q_gAAARY"]
[Wed Mar 25 00:51:24.797908 2026] [:error] [pid 57703:tid 58035] [client 158.158.111.117:60287] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/wso112233.php"] [unique_id "acLBDPIVQxDtjkklWGZRXQAAAFA"]
[Wed Mar 25 00:51:25.376453 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:61568] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/wso112233.php"] [unique_id "acLBDaS8TU_xcQFvlnb6zQAAAAM"]
[Wed Mar 25 00:51:26.039673 2026] [:error] [pid 57711:tid 58075] [client 158.158.111.117:60960] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/wso112233.php"] [unique_id "acLBDqLdPFdeRRktTdNRsgAAAJU"]
[Wed Mar 25 00:51:26.577223 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60308] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/wso112233.php"] [unique_id "acLBDg0pGUh6bwD3ouKEvwAAAMk"]
[Wed Mar 25 00:51:27.218547 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60233] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLBD-b25OL4yTv2fF9rCAAAARY"]
[Wed Mar 25 00:51:27.820333 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:61525] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLBD-b25OL4yTv2fF9rCQAAAQY"]
[Wed Mar 25 00:51:28.451961 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:59749] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLBEKLdPFdeRRktTdNRugAAAIQ"]
[Wed Mar 25 00:51:29.004403 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:59773] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "acLBEaLdPFdeRRktTdNRvAAAAIA"]
[Wed Mar 25 00:51:29.563062 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:61552] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bb.php"] [unique_id "acLBEaS8TU_xcQFvlnb6zgAAABY"]
[Wed Mar 25 00:51:30.133020 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:60339] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bb.php"] [unique_id "acLBEqLdPFdeRRktTdNRwAAAAJc"]
[Wed Mar 25 00:51:30.772391 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:59015] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bb.php"] [unique_id "acLBEqLdPFdeRRktTdNRwgAAAJI"]
[Wed Mar 25 00:51:31.380443 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:59096] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bb.php"] [unique_id "acLBE6S8TU_xcQFvlnb60AAAABA"]
[Wed Mar 25 00:51:31.974575 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:60910] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-title.php"] [unique_id "acLBE-b25OL4yTv2fF9rDQAAARE"]
[Wed Mar 25 00:51:32.605415 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60883] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-title.php"] [unique_id "acLBFOb25OL4yTv2fF9rDgAAAQc"]
[Wed Mar 25 00:51:33.259573 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:60317] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-title.php"] [unique_id "acLBFQ0pGUh6bwD3ouKEwwAAAM4"]
[Wed Mar 25 00:51:33.949644 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:59099] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-title.php"] [unique_id "acLBFQ0pGUh6bwD3ouKEygAAANA"]
[Wed Mar 25 00:51:34.557451 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:58222] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mga.php"] [unique_id "acLBFub25OL4yTv2fF9rIgAAAQs"]
[Wed Mar 25 00:51:51.118545 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:59717] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/y.php"] [unique_id "acLBJ_IVQxDtjkklWGZRkgAAAEg"]
[Wed Mar 25 00:51:51.716352 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:60274] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/y.php"] [unique_id "acLBJw0pGUh6bwD3ouKE9AAAAMI"]
[Wed Mar 25 00:51:52.302970 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:60905] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/y.php"] [unique_id "acLBKPIVQxDtjkklWGZRkwAAAEQ"]
[Wed Mar 25 00:51:52.899046 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:56903] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/y.php"] [unique_id "acLBKA0pGUh6bwD3ouKE9gAAANE"]
[Wed Mar 25 00:51:53.531751 2026] [:error] [pid 57703:tid 58034] [client 158.158.111.117:59009] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/logo_img.php"] [unique_id "acLBKfIVQxDtjkklWGZRlQAAAE8"]
[Wed Mar 25 00:51:54.070966 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59654] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/logo_img.php"] [unique_id "acLBKg0pGUh6bwD3ouKE-AAAANc"]
[Wed Mar 25 00:51:54.576567 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:58195] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/logo_img.php"] [unique_id "acLBKg0pGUh6bwD3ouKE-gAAAMg"]
[Wed Mar 25 00:51:55.222519 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:60880] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/logo_img.php"] [unique_id "acLBK-b25OL4yTv2fF9rXAAAAQ0"]
[Wed Mar 25 00:51:55.793964 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:59747] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spread.php"] [unique_id "acLBK6LdPFdeRRktTdNR6QAAAJc"]
[Wed Mar 25 00:51:56.334968 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:57715] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spread.php"] [unique_id "acLBLOb25OL4yTv2fF9rXgAAAQI"]
[Wed Mar 25 00:51:56.920042 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:59649] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spread.php"] [unique_id "acLBLOb25OL4yTv2fF9rYAAAAQs"]
[Wed Mar 25 00:51:57.596190 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:58220] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spread.php"] [unique_id "acLBLeb25OL4yTv2fF9rYQAAARc"]
[Wed Mar 25 00:51:58.143573 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:59650] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/21x.php"] [unique_id "acLBLqLdPFdeRRktTdNR7AAAAI4"]
[Wed Mar 25 00:51:58.650779 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:60293] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/21x.php"] [unique_id "acLBLub25OL4yTv2fF9rZgAAAQQ"]
[Wed Mar 25 00:51:59.135724 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:61630] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/21x.php"] [unique_id "acLBL-b25OL4yTv2fF9rZwAAARM"]
[Wed Mar 25 00:51:59.627658 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:58155] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/21x.php"] [unique_id "acLBL-b25OL4yTv2fF9rawAAARY"]
[Wed Mar 25 00:52:00.149024 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:60252] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/law.php"] [unique_id "acLBMOb25OL4yTv2fF9rbQAAAQU"]
[Wed Mar 25 00:52:00.731016 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:60925] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/law.php"] [unique_id "acLBMOb25OL4yTv2fF9rbgAAAQk"]
[Wed Mar 25 00:52:01.260770 2026] [:error] [pid 57703:tid 58024] [client 158.158.111.117:59044] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/law.php"] [unique_id "acLBMfIVQxDtjkklWGZRlgAAAEU"]
[Wed Mar 25 00:52:01.775037 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:60312] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/law.php"] [unique_id "acLBMfIVQxDtjkklWGZRmAAAAEc"]
[Wed Mar 25 00:52:02.257399 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:59675] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/leaf.php"] [unique_id "acLBMub25OL4yTv2fF9rcAAAAQs"]
[Wed Mar 25 00:52:02.824753 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:60975] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/leaf.php"] [unique_id "acLBMqLdPFdeRRktTdNR7gAAAI8"]
[Wed Mar 25 00:52:03.324536 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:58201] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/leaf.php"] [unique_id "acLBM-b25OL4yTv2fF9rdQAAAQE"]
[Wed Mar 25 00:52:03.845068 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:60873] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/leaf.php"] [unique_id "acLBMw0pGUh6bwD3ouKFAQAAANM"]
[Wed Mar 25 00:52:04.345871 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:59024] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gtc.php"] [unique_id "acLBNOb25OL4yTv2fF9rdwAAAQ8"]
[Wed Mar 25 00:52:04.925832 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:58125] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gtc.php"] [unique_id "acLBNA0pGUh6bwD3ouKFBQAAAMs"]
[Wed Mar 25 00:52:05.436879 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:60882] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gtc.php"] [unique_id "acLBNeb25OL4yTv2fF9reQAAAQ4"]
[Wed Mar 25 00:52:05.946438 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59737] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gtc.php"] [unique_id "acLBNeb25OL4yTv2fF9regAAAQo"]
[Wed Mar 25 00:52:06.488633 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:58148] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/st.php"] [unique_id "acLBNub25OL4yTv2fF9rewAAAQg"]
[Wed Mar 25 00:52:06.989485 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60959] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/st.php"] [unique_id "acLBNub25OL4yTv2fF9rfQAAAQc"]
[Wed Mar 25 00:52:07.497583 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60296] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/st.php"] [unique_id "acLBNw0pGUh6bwD3ouKFDAAAAMc"]
[Wed Mar 25 00:52:08.028657 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:59741] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/st.php"] [unique_id "acLBOOb25OL4yTv2fF9rggAAARM"]
[Wed Mar 25 00:52:08.669078 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:59770] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/AxAo.php"] [unique_id "acLBOOb25OL4yTv2fF9rhgAAARU"]
[Wed Mar 25 00:52:09.275951 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:60864] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/AxAo.php"] [unique_id "acLBOeb25OL4yTv2fF9riQAAAQg"]
[Wed Mar 25 00:52:09.842285 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:60951] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/AxAo.php"] [unique_id "acLBOfIVQxDtjkklWGZRnQAAAFE"]
[Wed Mar 25 00:52:10.401968 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:59744] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/AxAo.php"] [unique_id "acLBOvIVQxDtjkklWGZRngAAAFI"]
[Wed Mar 25 00:52:10.961502 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:58176] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0o0.php"] [unique_id "acLBOub25OL4yTv2fF9rjAAAAQk"]
[Wed Mar 25 00:52:11.580401 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:60979] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0o0.php"] [unique_id "acLBOw0pGUh6bwD3ouKFEAAAAMQ"]
[Wed Mar 25 00:52:12.088133 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60237] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0o0.php"] [unique_id "acLBPA0pGUh6bwD3ouKFEQAAAM0"]
[Wed Mar 25 00:52:12.600551 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:59767] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0o0.php"] [unique_id "acLBPOb25OL4yTv2fF9rjgAAAQA"]
[Wed Mar 25 00:52:13.134787 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59067] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sck.php"] [unique_id "acLBPQ0pGUh6bwD3ouKFEgAAANE"]
[Wed Mar 25 00:52:13.650414 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:61617] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sck.php"] [unique_id "acLBPQ0pGUh6bwD3ouKFFAAAANA"]
[Wed Mar 25 00:52:18.793250 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:57665] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sck.php"] [unique_id "acLBQqS8TU_xcQFvlnb7AwAAAAA"]
[Wed Mar 25 00:52:29.990530 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:60915] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efsd.php"] [unique_id "acLBTfIVQxDtjkklWGZRsgAAAE0"]
[Wed Mar 25 00:52:30.615103 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:59047] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efsd.php"] [unique_id "acLBTub25OL4yTv2fF9rqQAAAQk"]
[Wed Mar 25 00:52:31.305095 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60942] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efsd.php"] [unique_id "acLBT6S8TU_xcQFvlnb7CQAAAAc"]
[Wed Mar 25 00:52:31.814567 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:61558] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efsd.php"] [unique_id "acLBT-b25OL4yTv2fF9rsAAAAQA"]
[Wed Mar 25 00:52:32.377951 2026] [:error] [pid 57703:tid 58041] [client 158.158.111.117:59727] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccaef.php"] [unique_id "acLBUPIVQxDtjkklWGZRswAAAFY"]
[Wed Mar 25 00:52:32.899572 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:60965] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccaef.php"] [unique_id "acLBUOb25OL4yTv2fF9rtgAAARU"]
[Wed Mar 25 00:52:33.409642 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:60947] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccaef.php"] [unique_id "acLBUeb25OL4yTv2fF9ruAAAAQM"]
[Wed Mar 25 00:52:33.927571 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:60892] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ccaef.php"] [unique_id "acLBUeb25OL4yTv2fF9rvAAAAQk"]
[Wed Mar 25 00:52:34.618533 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:61536] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tll.php"] [unique_id "acLBUub25OL4yTv2fF9rvwAAARA"]
[Wed Mar 25 00:52:35.104236 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:59121] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tll.php"] [unique_id "acLBU-b25OL4yTv2fF9rwQAAARM"]
[Wed Mar 25 00:52:35.613824 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:59669] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tll.php"] [unique_id "acLBU-b25OL4yTv2fF9rxQAAAQ0"]
[Wed Mar 25 00:52:36.113894 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:60966] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tll.php"] [unique_id "acLBVPIVQxDtjkklWGZRtgAAAFI"]
[Wed Mar 25 00:52:36.611103 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:60313] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acLBVPIVQxDtjkklWGZRuAAAAFg"]
[Wed Mar 25 00:52:37.218766 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:59775] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acLBVeb25OL4yTv2fF9ryAAAARg"]
[Wed Mar 25 00:52:37.867287 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:58187] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acLBVeb25OL4yTv2fF9rygAAAQU"]
[Wed Mar 25 00:52:38.381156 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:60967] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acLBVqS8TU_xcQFvlnb7EgAAAA8"]
[Wed Mar 25 00:52:38.923117 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:61619] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aQw.php"] [unique_id "acLBVqS8TU_xcQFvlnb7FAAAABU"]
[Wed Mar 25 00:52:39.423724 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:58157] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aQw.php"] [unique_id "acLBV6S8TU_xcQFvlnb7FgAAAAc"]
[Wed Mar 25 00:52:40.038920 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:58200] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aQw.php"] [unique_id "acLBWOb25OL4yTv2fF9r0wAAAQQ"]
[Wed Mar 25 00:52:40.599732 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:61562] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aQw.php"] [unique_id "acLBWA0pGUh6bwD3ouKFMgAAAMs"]
[Wed Mar 25 00:52:41.167104 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:61614] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/unit.php"] [unique_id "acLBWQ0pGUh6bwD3ouKFNQAAANQ"]
[Wed Mar 25 00:52:41.675561 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:60890] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/unit.php"] [unique_id "acLBWfIVQxDtjkklWGZRuwAAAEw"]
[Wed Mar 25 00:52:42.230534 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:59078] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/unit.php"] [unique_id "acLBWub25OL4yTv2fF9r1QAAAQ8"]
[Wed Mar 25 00:52:42.743753 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:59734] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/unit.php"] [unique_id "acLBWub25OL4yTv2fF9r2QAAAQg"]
[Wed Mar 25 00:52:43.241012 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:60341] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acLBWw0pGUh6bwD3ouKFOQAAAMg"]
[Wed Mar 25 00:52:43.793602 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:60269] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acLBW-b25OL4yTv2fF9r4AAAAQQ"]
[Wed Mar 25 00:52:44.280068 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60335] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acLBXOb25OL4yTv2fF9r4wAAAQA"]
[Wed Mar 25 00:52:45.299186 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:60346] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acLBXfIVQxDtjkklWGZRwgAAAEA"]
[Wed Mar 25 00:52:45.852647 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:59699] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx.php"] [unique_id "acLBXfIVQxDtjkklWGZRwwAAAEc"]
[Wed Mar 25 00:52:46.457397 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:60294] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx.php"] [unique_id "acLBXub25OL4yTv2fF9r5gAAAQo"]
[Wed Mar 25 00:52:47.054058 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:59756] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx.php"] [unique_id "acLBX6LdPFdeRRktTdNSCAAAAJQ"]
[Wed Mar 25 00:52:47.666727 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:61556] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/nx.php"] [unique_id "acLBX_IVQxDtjkklWGZRxAAAAEE"]
[Wed Mar 25 00:52:48.198555 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:59060] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-advaced.php"] [unique_id "acLBYPIVQxDtjkklWGZRxQAAAE0"]
[Wed Mar 25 00:52:48.765280 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:59665] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-advaced.php"] [unique_id "acLBYKS8TU_xcQFvlnb7HAAAAAU"]
[Wed Mar 25 00:52:49.311563 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:57619] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-advaced.php"] [unique_id "acLBYaLdPFdeRRktTdNSCwAAAI0"]
[Wed Mar 25 00:52:49.869392 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:60977] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-advaced.php"] [unique_id "acLBYaS8TU_xcQFvlnb7HwAAABE"]
[Wed Mar 25 00:53:09.542603 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:61529] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anz.php"] [unique_id "acLBdaS8TU_xcQFvlnb7SAAAAAA"]
[Wed Mar 25 00:53:10.029551 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:59745] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anz.php"] [unique_id "acLBdub25OL4yTv2fF9sHwAAARA"]
[Wed Mar 25 00:53:10.582337 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:60333] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anz.php"] [unique_id "acLBdqLdPFdeRRktTdNSIQAAAIw"]
[Wed Mar 25 00:53:11.119342 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:58183] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anz.php"] [unique_id "acLBd-b25OL4yTv2fF9sIgAAAQ0"]
[Wed Mar 25 00:53:11.648903 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:61590] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bge.php"] [unique_id "acLBd-b25OL4yTv2fF9sKgAAAQU"]
[Wed Mar 25 00:53:12.151979 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:58215] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bge.php"] [unique_id "acLBeKLdPFdeRRktTdNSIgAAAJg"]
[Wed Mar 25 00:53:12.678797 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:60969] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bge.php"] [unique_id "acLBeKLdPFdeRRktTdNSJAAAAJI"]
[Wed Mar 25 00:53:13.213527 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:60315] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bge.php"] [unique_id "acLBeeb25OL4yTv2fF9sNAAAARA"]
[Wed Mar 25 00:53:13.702933 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:60325] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acLBeaLdPFdeRRktTdNSJgAAAJM"]
[Wed Mar 25 00:53:14.228151 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:59771] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acLBeub25OL4yTv2fF9sOQAAAQM"]
[Wed Mar 25 00:53:14.779121 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:59125] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acLBeub25OL4yTv2fF9sPAAAAQk"]
[Wed Mar 25 00:53:15.265813 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:61513] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acLBew0pGUh6bwD3ouKFTgAAANg"]
[Wed Mar 25 00:53:15.765026 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:60289] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v2.php"] [unique_id "acLBew0pGUh6bwD3ouKFUQAAAMU"]
[Wed Mar 25 00:53:16.307106 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:60303] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v2.php"] [unique_id "acLBfKS8TU_xcQFvlnb7TQAAABU"]
[Wed Mar 25 00:53:16.817627 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59763] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v2.php"] [unique_id "acLBfA0pGUh6bwD3ouKFVAAAAM0"]
[Wed Mar 25 00:53:17.330334 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:61560] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v2.php"] [unique_id "acLBfQ0pGUh6bwD3ouKFVwAAAMo"]
[Wed Mar 25 00:53:17.838128 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60946] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5e0a.php"] [unique_id "acLBfeb25OL4yTv2fF9sSgAAAQA"]
[Wed Mar 25 00:53:18.392358 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:60900] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5e0a.php"] [unique_id "acLBfqLdPFdeRRktTdNSMQAAAJg"]
[Wed Mar 25 00:53:18.913417 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:58152] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5e0a.php"] [unique_id "acLBfvIVQxDtjkklWGZR-gAAAE0"]
[Wed Mar 25 00:53:19.458446 2026] [:error] [pid 57703:tid 58042] [client 158.158.111.117:57671] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5e0a.php"] [unique_id "acLBf_IVQxDtjkklWGZR_QAAAFc"]
[Wed Mar 25 00:53:19.955717 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:61517] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hly.php"] [unique_id "acLBf6LdPFdeRRktTdNSMwAAAJI"]
[Wed Mar 25 00:53:20.480475 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:61601] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hly.php"] [unique_id "acLBgOb25OL4yTv2fF9sWwAAAQs"]
[Wed Mar 25 00:53:21.052322 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:60277] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hly.php"] [unique_id "acLBgaLdPFdeRRktTdNSNgAAAIc"]
[Wed Mar 25 00:53:21.560654 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60922] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hly.php"] [unique_id "acLBgaLdPFdeRRktTdNSOgAAAII"]
[Wed Mar 25 00:53:22.054204 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59707] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cyber.php"] [unique_id "acLBgub25OL4yTv2fF9saQAAAQY"]
[Wed Mar 25 00:53:22.572967 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:61530] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cyber.php"] [unique_id "acLBgqS8TU_xcQFvlnb7WwAAAA4"]
[Wed Mar 25 00:53:23.052778 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:61510] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cyber.php"] [unique_id "acLBg-b25OL4yTv2fF9scgAAARg"]
[Wed Mar 25 00:53:23.656887 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:58151] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cyber.php"] [unique_id "acLBg6LdPFdeRRktTdNSPQAAAIA"]
[Wed Mar 25 00:53:24.172977 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:59086] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp1.php"] [unique_id "acLBhOb25OL4yTv2fF9sewAAARU"]
[Wed Mar 25 00:53:24.751603 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:59039] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp1.php"] [unique_id "acLBhKLdPFdeRRktTdNSQgAAAIk"]
[Wed Mar 25 00:53:25.262331 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:61555] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp1.php"] [unique_id "acLBheb25OL4yTv2fF9sgQAAAQs"]
[Wed Mar 25 00:53:25.863212 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:60249] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp1.php"] [unique_id "acLBheb25OL4yTv2fF9shgAAAQM"]
[Wed Mar 25 00:53:26.367292 2026] [:error] [pid 57702:tid 57903] [client 158.158.111.117:59772] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wefile.php"] [unique_id "acLBhqS8TU_xcQFvlnb7XgAAAAA"]
[Wed Mar 25 00:53:26.860104 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:59029] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wefile.php"] [unique_id "acLBhqS8TU_xcQFvlnb7ZAAAAA8"]
[Wed Mar 25 00:53:27.399420 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:61554] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wefile.php"] [unique_id "acLBh6LdPFdeRRktTdNSRwAAAIc"]
[Wed Mar 25 00:53:27.885450 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:61563] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wefile.php"] [unique_id "acLBhw0pGUh6bwD3ouKFbQAAANA"]
[Wed Mar 25 00:53:28.458549 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60964] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/khgdl.php"] [unique_id "acLBiA0pGUh6bwD3ouKFcwAAAMA"]
[Wed Mar 25 00:53:28.948289 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:60328] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/khgdl.php"] [unique_id "acLBiA0pGUh6bwD3ouKFdQAAANg"]
[Wed Mar 25 00:53:29.531467 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:60902] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/khgdl.php"] [unique_id "acLBiaS8TU_xcQFvlnb7ZwAAAAY"]
[Wed Mar 25 00:53:30.048104 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60292] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/khgdl.php"] [unique_id "acLBiqS8TU_xcQFvlnb7aQAAAAM"]
[Wed Mar 25 00:53:30.641248 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:60305] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "acLBivIVQxDtjkklWGZSCwAAAEA"]
[Wed Mar 25 00:53:31.173785 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:60297] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "acLBi-b25OL4yTv2fF9snwAAARU"]
[Wed Mar 25 00:53:31.660782 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:61602] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "acLBiw0pGUh6bwD3ouKFgwAAANg"]
[Wed Mar 25 00:53:32.167396 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:56897] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/about.php"] [unique_id "acLBjOb25OL4yTv2fF9soQAAAQQ"]
[Wed Mar 25 00:53:33.033989 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59110] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/system.php"] [unique_id "acLBjQ0pGUh6bwD3ouKFiAAAANE"]
[Wed Mar 25 00:53:33.518182 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:59080] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/system.php"] [unique_id "acLBjQ0pGUh6bwD3ouKFigAAANQ"]
[Wed Mar 25 00:53:34.018204 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60301] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/system.php"] [unique_id "acLBjub25OL4yTv2fF9sqwAAARI"]
[Wed Mar 25 00:53:34.577637 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60336] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/system.php"] [unique_id "acLBjub25OL4yTv2fF9srwAAAQc"]
[Wed Mar 25 00:53:35.118676 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:60282] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dlex.php"] [unique_id "acLBj-b25OL4yTv2fF9stQAAARM"]
[Wed Mar 25 00:53:35.633185 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60984] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dlex.php"] [unique_id "acLBj6S8TU_xcQFvlnb7bAAAAAs"]
[Wed Mar 25 00:53:36.170227 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:60872] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dlex.php"] [unique_id "acLBkPIVQxDtjkklWGZSFQAAAEg"]
[Wed Mar 25 00:53:36.674887 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:60285] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dlex.php"] [unique_id "acLBkA0pGUh6bwD3ouKFkwAAAMU"]
[Wed Mar 25 00:53:37.201575 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:59726] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsad.php"] [unique_id "acLBkaS8TU_xcQFvlnb7dAAAABE"]
[Wed Mar 25 00:53:37.785656 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60261] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsad.php"] [unique_id "acLBkQ0pGUh6bwD3ouKFnAAAANA"]
[Wed Mar 25 00:53:38.315372 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:61575] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsad.php"] [unique_id "acLBkub25OL4yTv2fF9swgAAAQM"]
[Wed Mar 25 00:53:38.846095 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:59750] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsad.php"] [unique_id "acLBkg0pGUh6bwD3ouKFpwAAANI"]
[Wed Mar 25 00:53:39.359774 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:60288] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atx.php"] [unique_id "acLBk6S8TU_xcQFvlnb7dgAAABg"]
[Wed Mar 25 00:53:39.882695 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:60983] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atx.php"] [unique_id "acLBkw0pGUh6bwD3ouKFsgAAANU"]
[Wed Mar 25 00:53:40.375255 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:61527] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atx.php"] [unique_id "acLBlKS8TU_xcQFvlnb7fAAAAAM"]
[Wed Mar 25 00:53:40.935104 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:61595] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/atx.php"] [unique_id "acLBlKLdPFdeRRktTdNSSgAAAII"]
[Wed Mar 25 00:53:41.556412 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60266] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "acLBleb25OL4yTv2fF9szQAAARI"]
[Wed Mar 25 00:53:42.062309 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60986] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "acLBlg0pGUh6bwD3ouKFuAAAAMw"]
[Wed Mar 25 00:53:42.676037 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:59708] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "acLBlqLdPFdeRRktTdNSSwAAAIU"]
[Wed Mar 25 00:53:43.190776 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:60236] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "acLBl6LdPFdeRRktTdNSTAAAAJE"]
[Wed Mar 25 00:53:43.702157 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:59691] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dout.php"] [unique_id "acLBl6LdPFdeRRktTdNSTgAAAJQ"]
[Wed Mar 25 00:53:44.311060 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59751] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dout.php"] [unique_id "acLBmA0pGUh6bwD3ouKFvAAAAM0"]
[Wed Mar 25 00:53:44.790313 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:59020] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dout.php"] [unique_id "acLBmA0pGUh6bwD3ouKFvgAAANA"]
[Wed Mar 25 00:53:45.272116 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:60887] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dout.php"] [unique_id "acLBmaS8TU_xcQFvlnb7jwAAAAg"]
[Wed Mar 25 00:53:45.766207 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:60884] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/C.php"] [unique_id "acLBmeb25OL4yTv2fF9s3wAAAQE"]
[Wed Mar 25 00:53:46.250752 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:59657] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/C.php"] [unique_id "acLBmub25OL4yTv2fF9s4wAAARg"]
[Wed Mar 25 00:53:46.829611 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:61631] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/C.php"] [unique_id "acLBmg0pGUh6bwD3ouKFxgAAAMk"]
[Wed Mar 25 00:53:47.346097 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:59728] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/C.php"] [unique_id "acLBm-b25OL4yTv2fF9s6QAAAQg"]
[Wed Mar 25 00:53:47.924017 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:57700] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anon.php"] [unique_id "acLBm-b25OL4yTv2fF9s8AAAARQ"]
[Wed Mar 25 00:53:48.411645 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:61543] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anon.php"] [unique_id "acLBnOb25OL4yTv2fF9s8gAAAQA"]
[Wed Mar 25 00:53:48.930622 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:58237] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anon.php"] [unique_id "acLBnOb25OL4yTv2fF9s9gAAAQY"]
[Wed Mar 25 00:53:49.488897 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:58125] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/anon.php"] [unique_id "acLBnaS8TU_xcQFvlnb7lgAAABE"]
[Wed Mar 25 00:53:50.025198 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:61607] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3.php"] [unique_id "acLBnub25OL4yTv2fF9s-gAAAQI"]
[Wed Mar 25 00:53:50.646417 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:57701] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3.php"] [unique_id "acLBnqS8TU_xcQFvlnb7mgAAAAU"]
[Wed Mar 25 00:53:51.170224 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:61593] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3.php"] [unique_id "acLBn6LdPFdeRRktTdNSTwAAAIA"]
[Wed Mar 25 00:53:51.708019 2026] [:error] [pid 57711:tid 58060] [client 158.158.111.117:61573] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/v3.php"] [unique_id "acLBn6LdPFdeRRktTdNSUQAAAIg"]
[Wed Mar 25 00:53:52.317870 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:60952] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acLBoPIVQxDtjkklWGZSGwAAAEs"]
[Wed Mar 25 00:53:52.821696 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60954] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acLBoA0pGUh6bwD3ouKF2AAAAM8"]
[Wed Mar 25 00:53:53.375647 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60329] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acLBoeb25OL4yTv2fF9tAQAAAQA"]
[Wed Mar 25 00:53:53.866094 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:57642] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acLBoeb25OL4yTv2fF9tBQAAARY"]
[Wed Mar 25 00:53:54.359758 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59733] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xenium4.php"] [unique_id "acLBog0pGUh6bwD3ouKF3wAAAM0"]
[Wed Mar 25 00:53:54.903689 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60334] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xenium4.php"] [unique_id "acLBoub25OL4yTv2fF9tCgAAAQ8"]
[Wed Mar 25 00:53:55.392919 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:61583] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xenium4.php"] [unique_id "acLBo6LdPFdeRRktTdNSUwAAAIw"]
[Wed Mar 25 00:53:55.932048 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:59764] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xenium4.php"] [unique_id "acLBo6LdPFdeRRktTdNSVQAAAJg"]
[Wed Mar 25 00:53:56.434157 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60251] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/worm0.PhP7"] [unique_id "acLBpA0pGUh6bwD3ouKF6AAAAMM"]
[Wed Mar 25 00:53:56.998443 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60932] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/worm0.PhP7"] [unique_id "acLBpKS8TU_xcQFvlnb7oQAAAAc"]
[Wed Mar 25 00:53:57.527684 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:60267] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/worm0.PhP7"] [unique_id "acLBpaS8TU_xcQFvlnb7owAAABY"]
[Wed Mar 25 00:53:58.047458 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:60242] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/worm0.PhP7"] [unique_id "acLBpqS8TU_xcQFvlnb7pAAAABI"]
[Wed Mar 25 00:53:58.623539 2026] [:error] [pid 57711:tid 58075] [client 158.158.111.117:60276] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "acLBpqLdPFdeRRktTdNSWAAAAJU"]
[Wed Mar 25 00:53:59.217954 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:59090] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "acLBpw0pGUh6bwD3ouKF9wAAAMo"]
[Wed Mar 25 00:53:59.711272 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:60930] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "acLBp6LdPFdeRRktTdNSWgAAAIc"]
[Wed Mar 25 00:54:00.262835 2026] [:error] [pid 57703:tid 58035] [client 158.158.111.117:60309] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wsd.php"] [unique_id "acLBqPIVQxDtjkklWGZSJQAAAFA"]
[Wed Mar 25 00:54:00.860414 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:56874] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hjkj.php"] [unique_id "acLBqA0pGUh6bwD3ouKF-wAAAME"]
[Wed Mar 25 00:54:01.356442 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:58226] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hjkj.php"] [unique_id "acLBqaS8TU_xcQFvlnb7qwAAAA8"]
[Wed Mar 25 00:54:01.885273 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60924] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hjkj.php"] [unique_id "acLBqQ0pGUh6bwD3ouKGAAAAAMY"]
[Wed Mar 25 00:54:02.423525 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59753] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hjkj.php"] [unique_id "acLBqg0pGUh6bwD3ouKGBQAAANE"]
[Wed Mar 25 00:54:03.797556 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:59053] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-sid.php"] [unique_id "acLBqw0pGUh6bwD3ouKGEwAAAME"]
[Wed Mar 25 00:54:04.290625 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:59725] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-sid.php"] [unique_id "acLBrKS8TU_xcQFvlnb7rQAAAAU"]
[Wed Mar 25 00:54:04.780084 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:58167] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-sid.php"] [unique_id "acLBrA0pGUh6bwD3ouKGHAAAANI"]
[Wed Mar 25 00:54:05.352796 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59672] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-sid.php"] [unique_id "acLBrQ0pGUh6bwD3ouKGIQAAANc"]
[Wed Mar 25 00:54:05.866076 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60344] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx21_1.php"] [unique_id "acLBrQ0pGUh6bwD3ouKGJgAAANY"]
[Wed Mar 25 00:54:06.457056 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:59739] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx21_1.php"] [unique_id "acLBrub25OL4yTv2fF9tDQAAAQ0"]
[Wed Mar 25 00:54:07.047169 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:60874] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx21_1.php"] [unique_id "acLBr6LdPFdeRRktTdNSiAAAAJQ"]
[Wed Mar 25 00:54:07.700963 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:60344] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sx21_1.php"] [unique_id "acLBr6LdPFdeRRktTdNSjwAAAIw"]
[Wed Mar 25 00:54:19.587634 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60227] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "acLBuw0pGUh6bwD3ouKGcgAAAMw"]
[Wed Mar 25 00:54:25.507229 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:60318] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "acLBwaLdPFdeRRktTdNSzwAAAI4"]
[Wed Mar 25 00:54:26.089532 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:59653] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ex.php"] [unique_id "acLBwqLdPFdeRRktTdNS0AAAAJA"]
[Wed Mar 25 00:54:26.604889 2026] [:error] [pid 57703:tid 58028] [client 158.158.111.117:60976] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ex.php"] [unique_id "acLBwvIVQxDtjkklWGZSZwAAAEk"]
[Wed Mar 25 00:54:27.144586 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:60928] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ex.php"] [unique_id "acLBw-b25OL4yTv2fF9tdQAAAQg"]
[Wed Mar 25 00:54:27.678472 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:60968] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ex.php"] [unique_id "acLBw-b25OL4yTv2fF9teQAAAQs"]
[Wed Mar 25 00:54:28.250742 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:58175] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xajxfrbx.php"] [unique_id "acLBxOb25OL4yTv2fF9tfgAAAQA"]
[Wed Mar 25 00:54:28.788571 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60233] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xajxfrbx.php"] [unique_id "acLBxOb25OL4yTv2fF9thgAAAQ8"]
[Wed Mar 25 00:54:29.322763 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:61514] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xajxfrbx.php"] [unique_id "acLBxaS8TU_xcQFvlnb74AAAABE"]
[Wed Mar 25 00:54:32.551111 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:60865] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xajxfrbx.php"] [unique_id "acLByOb25OL4yTv2fF9tjQAAARA"]
[Wed Mar 25 00:54:33.145665 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:59695] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "acLByeb25OL4yTv2fF9tkQAAAQM"]
[Wed Mar 25 00:54:33.719295 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:56895] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "acLByfIVQxDtjkklWGZSfAAAAEc"]
[Wed Mar 25 00:54:34.268186 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:61598] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "acLByg0pGUh6bwD3ouKGnQAAANE"]
[Wed Mar 25 00:54:34.802184 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:59769] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yu.php"] [unique_id "acLByvIVQxDtjkklWGZSgAAAAFg"]
[Wed Mar 25 00:54:35.298402 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:57712] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acLBy6LdPFdeRRktTdNS2gAAAI0"]
[Wed Mar 25 00:54:35.851714 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:58138] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acLByw0pGUh6bwD3ouKGpgAAAMg"]
[Wed Mar 25 00:54:36.349101 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:60981] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acLBzKS8TU_xcQFvlnb76AAAAAY"]
[Wed Mar 25 00:54:36.860950 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:58202] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acLBzKLdPFdeRRktTdNS3AAAAIE"]
[Wed Mar 25 00:54:37.508550 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:61612] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mari.php"] [unique_id "acLBzQ0pGUh6bwD3ouKGqQAAAMA"]
[Wed Mar 25 00:54:37.996588 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:58132] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mari.php"] [unique_id "acLBzaLdPFdeRRktTdNS3gAAAIk"]
[Wed Mar 25 00:54:38.522504 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:60304] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mari.php"] [unique_id "acLBzqLdPFdeRRktTdNS4gAAAIs"]
[Wed Mar 25 00:54:39.014606 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:61584] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mari.php"] [unique_id "acLBz6LdPFdeRRktTdNS5AAAAIw"]
[Wed Mar 25 00:54:39.510482 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59737] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/www.php"] [unique_id "acLBzw0pGUh6bwD3ouKGsgAAANE"]
[Wed Mar 25 00:54:40.079826 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60349] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/www.php"] [unique_id "acLB0A0pGUh6bwD3ouKGtAAAAME"]
[Wed Mar 25 00:54:41.101411 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:58147] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/www.php"] [unique_id "acLB0eb25OL4yTv2fF9tngAAARI"]
[Wed Mar 25 00:54:41.612286 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:56892] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/www.php"] [unique_id "acLB0Q0pGUh6bwD3ouKGvwAAANc"]
[Wed Mar 25 00:54:42.097194 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:57679] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acLB0ub25OL4yTv2fF9tpAAAAQM"]
[Wed Mar 25 00:54:42.614046 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:59758] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acLB0qLdPFdeRRktTdNS6gAAAJM"]
[Wed Mar 25 00:54:43.154958 2026] [:error] [pid 57703:tid 58026] [client 158.158.111.117:60958] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acLB0_IVQxDtjkklWGZSjgAAAEc"]
[Wed Mar 25 00:54:43.671354 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:58139] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/404.php"] [unique_id "acLB0-b25OL4yTv2fF9tqwAAAQA"]
[Wed Mar 25 00:54:44.184501 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:60957] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "acLB1Ob25OL4yTv2fF9trQAAAQU"]
[Wed Mar 25 00:54:44.668083 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:59652] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "acLB1Ob25OL4yTv2fF9trwAAAQ4"]
[Wed Mar 25 00:54:45.226353 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:59689] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "acLB1eb25OL4yTv2fF9ttQAAAQg"]
[Wed Mar 25 00:54:45.761747 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:59680] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/css/colors/blue/index.php"] [unique_id "acLB1fIVQxDtjkklWGZSkQAAAFE"]
[Wed Mar 25 00:54:46.245406 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:58170] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s12.php"] [unique_id "acLB1qLdPFdeRRktTdNS9AAAAIw"]
[Wed Mar 25 00:54:46.750026 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:58123] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s12.php"] [unique_id "acLB1qLdPFdeRRktTdNS9gAAAJI"]
[Wed Mar 25 00:54:47.252548 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:59059] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s12.php"] [unique_id "acLB16LdPFdeRRktTdNS-AAAAI8"]
[Wed Mar 25 00:54:47.863997 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:60331] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/s12.php"] [unique_id "acLB16S8TU_xcQFvlnb7_AAAAAk"]
[Wed Mar 25 00:54:48.421400 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:57699] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rxr.php"] [unique_id "acLB2PIVQxDtjkklWGZSlQAAAEM"]
[Wed Mar 25 00:54:48.973478 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:60314] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rxr.php"] [unique_id "acLB2Ob25OL4yTv2fF9tuwAAARU"]
[Wed Mar 25 00:54:49.738646 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:61610] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rxr.php"] [unique_id "acLB2aLdPFdeRRktTdNTAAAAAIo"]
[Wed Mar 25 00:54:50.327597 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:58180] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/rxr.php"] [unique_id "acLB2g0pGUh6bwD3ouKG0wAAANU"]
[Wed Mar 25 00:54:50.879015 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:61603] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acLB2g0pGUh6bwD3ouKG1gAAANg"]
[Wed Mar 25 00:54:51.383835 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:61585] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acLB2_IVQxDtjkklWGZSlwAAAEw"]
[Wed Mar 25 00:54:51.958784 2026] [:error] [pid 57702:tid 57923] [client 158.158.111.117:60895] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acLB26S8TU_xcQFvlnb8DgAAABQ"]
[Wed Mar 25 00:54:52.568609 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:60940] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acLB3KS8TU_xcQFvlnb8EgAAAAk"]
[Wed Mar 25 00:54:53.129763 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:61522] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xg5Bv6XIUw.php"] [unique_id "acLB3Q0pGUh6bwD3ouKG3AAAAMo"]
[Wed Mar 25 00:54:53.642649 2026] [:error] [pid 57702:tid 57913] [client 158.158.111.117:59033] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xg5Bv6XIUw.php"] [unique_id "acLB3aS8TU_xcQFvlnb8GAAAAAo"]
[Wed Mar 25 00:54:54.168017 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:61611] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xg5Bv6XIUw.php"] [unique_id "acLB3qLdPFdeRRktTdNTBwAAAIA"]
[Wed Mar 25 00:54:54.742382 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:61505] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8xg5Bv6XIUw.php"] [unique_id "acLB3qS8TU_xcQFvlnb8HgAAAAU"]
[Wed Mar 25 00:54:55.281895 2026] [:error] [pid 57702:tid 57916] [client 158.158.111.117:59656] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "acLB36S8TU_xcQFvlnb8IAAAAA0"]
[Wed Mar 25 00:54:55.818369 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:60899] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "acLB36LdPFdeRRktTdNTCQAAAI8"]
[Wed Mar 25 00:54:56.316481 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:59716] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "acLB4Ob25OL4yTv2fF9twgAAAQ8"]
[Wed Mar 25 00:54:56.863628 2026] [:error] [pid 57702:tid 57912] [client 158.158.111.117:61533] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2clas.php"] [unique_id "acLB4KS8TU_xcQFvlnb8JQAAAAk"]
[Wed Mar 25 00:54:57.416629 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:61570] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Codex.php"] [unique_id "acLB4aS8TU_xcQFvlnb8KgAAAAs"]
[Wed Mar 25 00:54:57.970689 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:57636] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Codex.php"] [unique_id "acLB4eb25OL4yTv2fF9tyAAAARE"]
[Wed Mar 25 00:54:58.487968 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60929] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Codex.php"] [unique_id "acLB4ub25OL4yTv2fF9tzQAAARY"]
[Wed Mar 25 00:54:58.995293 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:57689] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Codex.php"] [unique_id "acLB4g0pGUh6bwD3ouKG4QAAAM4"]
[Wed Mar 25 00:54:59.515551 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:56899] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/insoamv.php"] [unique_id "acLB4-b25OL4yTv2fF9t1QAAARQ"]
[Wed Mar 25 00:55:00.057319 2026] [:error] [pid 57703:tid 58033] [client 158.158.111.117:60875] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/insoamv.php"] [unique_id "acLB5PIVQxDtjkklWGZSpQAAAE4"]
[Wed Mar 25 00:55:00.561572 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:57641] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/insoamv.php"] [unique_id "acLB5PIVQxDtjkklWGZSqAAAAEM"]
[Wed Mar 25 00:55:01.067078 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:60231] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/insoamv.php"] [unique_id "acLB5fIVQxDtjkklWGZSqwAAAEg"]
[Wed Mar 25 00:55:01.629490 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59754] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "acLB5Q0pGUh6bwD3ouKG5gAAAMA"]
[Wed Mar 25 00:55:02.162721 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:55732] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "acLB5g0pGUh6bwD3ouKG6QAAANg"]
[Wed Mar 25 00:55:02.723627 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:61565] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "acLB5qLdPFdeRRktTdNTEQAAAIE"]
[Wed Mar 25 00:55:03.346753 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:61623] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "acLB5w0pGUh6bwD3ouKG8AAAANE"]
[Wed Mar 25 00:55:03.878027 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:59668] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acLB56LdPFdeRRktTdNTFwAAAJY"]
[Wed Mar 25 00:55:04.420263 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:59674] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acLB6KLdPFdeRRktTdNTHgAAAI8"]
[Wed Mar 25 00:55:04.905411 2026] [:error] [pid 57711:tid 58068] [client 158.158.111.117:58230] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acLB6KLdPFdeRRktTdNTIgAAAI4"]
[Wed Mar 25 00:55:05.394808 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:58229] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/55b76.php"] [unique_id "acLB6Q0pGUh6bwD3ouKG-AAAANc"]
[Wed Mar 25 00:55:05.893042 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:58120] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-home.php"] [unique_id "acLB6Q0pGUh6bwD3ouKG-gAAANM"]
[Wed Mar 25 00:55:06.405856 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:60256] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-home.php"] [unique_id "acLB6ub25OL4yTv2fF9t3QAAAQ0"]
[Wed Mar 25 00:55:06.890357 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:59022] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-home.php"] [unique_id "acLB6g0pGUh6bwD3ouKG_AAAANA"]
[Wed Mar 25 00:55:07.416118 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:60876] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-home.php"] [unique_id "acLB6w0pGUh6bwD3ouKHAAAAAM8"]
[Wed Mar 25 00:55:07.907566 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:59089] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/autoload_classmap.php"] [unique_id "acLB6-b25OL4yTv2fF9t4QAAARY"]
[Wed Mar 25 00:55:08.422961 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60933] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/autoload_classmap.php"] [unique_id "acLB7A0pGUh6bwD3ouKHBAAAAMc"]
[Wed Mar 25 00:55:09.006844 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:59076] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/autoload_classmap.php"] [unique_id "acLB7eb25OL4yTv2fF9t4wAAARc"]
[Wed Mar 25 00:55:09.485625 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:61549] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/autoload_classmap.php"] [unique_id "acLB7Q0pGUh6bwD3ouKHDAAAAMw"]
[Wed Mar 25 00:55:10.031091 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:57681] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "acLB7g0pGUh6bwD3ouKHFQAAAMs"]
[Wed Mar 25 00:55:10.512937 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:61629] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "acLB7ub25OL4yTv2fF9t5wAAAQY"]
[Wed Mar 25 00:55:11.043176 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60254] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "acLB7-b25OL4yTv2fF9t6gAAAQ8"]
[Wed Mar 25 00:55:11.580898 2026] [:error] [pid 20371:tid 20385] [client 158.158.111.117:61578] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file5.php"] [unique_id "acLB7-b25OL4yTv2fF9t7wAAAQw"]
[Wed Mar 25 00:55:12.234736 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:58172] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zz10.php"] [unique_id "acLB8A0pGUh6bwD3ouKHIgAAAMs"]
[Wed Mar 25 00:55:12.755478 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:58228] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zz10.php"] [unique_id "acLB8KS8TU_xcQFvlnb8RwAAABE"]
[Wed Mar 25 00:55:13.360575 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:57727] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zz10.php"] [unique_id "acLB8aLdPFdeRRktTdNTNQAAAIA"]
[Wed Mar 25 00:55:14.114537 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:59062] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zz10.php"] [unique_id "acLB8qLdPFdeRRktTdNTNgAAAJE"]
[Wed Mar 25 00:55:14.729567 2026] [:error] [pid 57703:tid 58033] [client 158.158.111.117:61544] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "acLB8vIVQxDtjkklWGZSvAAAAE4"]
[Wed Mar 25 00:55:15.269592 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:61550] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "acLB8-b25OL4yTv2fF9t9AAAAQk"]
[Wed Mar 25 00:55:15.994408 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:58235] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "acLB8w0pGUh6bwD3ouKHKgAAANg"]
[Wed Mar 25 00:55:16.666203 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:59714] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/classwithtostring.php"] [unique_id "acLB9KLdPFdeRRktTdNTOwAAAIY"]
[Wed Mar 25 00:55:17.315514 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:60280] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ths.php"] [unique_id "acLB9aLdPFdeRRktTdNTPwAAAIk"]
[Wed Mar 25 00:55:17.910983 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:59655] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ths.php"] [unique_id "acLB9aLdPFdeRRktTdNTRgAAAJI"]
[Wed Mar 25 00:55:18.574879 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:60337] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ths.php"] [unique_id "acLB9vIVQxDtjkklWGZSxQAAAEQ"]
[Wed Mar 25 00:55:19.650685 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:57643] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ths.php"] [unique_id "acLB9_IVQxDtjkklWGZSyAAAAE0"]
[Wed Mar 25 00:55:21.594321 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:59765] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ea3f.php"] [unique_id "acLB-eb25OL4yTv2fF9uFgAAARg"]
[Wed Mar 25 00:55:22.799334 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:59754] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ea3f.php"] [unique_id "acLB-g0pGUh6bwD3ouKHNQAAANc"]
[Wed Mar 25 00:55:23.615142 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:59774] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ea3f.php"] [unique_id "acLB-6LdPFdeRRktTdNTWgAAAIw"]
[Wed Mar 25 00:55:37.620377 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:57709] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "acLCCeb25OL4yTv2fF9uOgAAAQU"]
[Wed Mar 25 00:55:39.376562 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:61594] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acLCC6S8TU_xcQFvlnb8dAAAAAM"]
[Wed Mar 25 00:55:45.002853 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:59735] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ww1.php"] [unique_id "acLCEeb25OL4yTv2fF9uYwAAARI"]
[Wed Mar 25 00:55:45.537212 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:59648] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ww1.php"] [unique_id "acLCEeb25OL4yTv2fF9uaAAAAQ8"]
[Wed Mar 25 00:55:46.080581 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:60870] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ww1.php"] [unique_id "acLCEqLdPFdeRRktTdNToQAAAIs"]
[Wed Mar 25 00:55:46.721870 2026] [:error] [pid 20371:tid 20385] [client 158.158.111.117:59720] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ww1.php"] [unique_id "acLCEub25OL4yTv2fF9ubwAAAQw"]
[Wed Mar 25 00:55:47.272370 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:60235] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "acLCE-b25OL4yTv2fF9ucQAAAQU"]
[Wed Mar 25 00:55:48.222337 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:60921] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "acLCFOb25OL4yTv2fF9ucwAAAQs"]
[Wed Mar 25 00:55:48.913667 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:59723] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "acLCFOb25OL4yTv2fF9ueQAAARQ"]
[Wed Mar 25 00:55:49.396656 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:60239] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "acLCFQ0pGUh6bwD3ouKHaAAAAMs"]
[Wed Mar 25 00:55:50.137795 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:61553] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "acLCFg0pGUh6bwD3ouKHbAAAAM8"]
[Wed Mar 25 00:55:50.722099 2026] [:error] [pid 57703:tid 58043] [client 158.158.111.117:61537] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "acLCFvIVQxDtjkklWGZTEwAAAFg"]
[Wed Mar 25 00:55:51.217530 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:58204] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "acLCFw0pGUh6bwD3ouKHdAAAANU"]
[Wed Mar 25 00:55:51.753428 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:61548] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "acLCFw0pGUh6bwD3ouKHegAAAMs"]
[Wed Mar 25 00:55:52.302004 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:61547] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-22.php"] [unique_id "acLCGKLdPFdeRRktTdNTpgAAAJQ"]
[Wed Mar 25 00:55:52.787639 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:59682] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-22.php"] [unique_id "acLCGKLdPFdeRRktTdNTpwAAAJM"]
[Wed Mar 25 00:55:53.293399 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59718] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-22.php"] [unique_id "acLCGQ0pGUh6bwD3ouKHfwAAAMw"]
[Wed Mar 25 00:55:53.907398 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:60909] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-22.php"] [unique_id "acLCGeb25OL4yTv2fF9uhgAAAQY"]
[Wed Mar 25 00:55:54.423931 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:59685] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/first.php"] [unique_id "acLCGg0pGUh6bwD3ouKHggAAANg"]
[Wed Mar 25 00:55:54.932165 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:59100] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/first.php"] [unique_id "acLCGub25OL4yTv2fF9uigAAARQ"]
[Wed Mar 25 00:55:55.551534 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:60937] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/first.php"] [unique_id "acLCG6S8TU_xcQFvlnb8gAAAAA4"]
[Wed Mar 25 00:55:56.050277 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60244] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/first.php"] [unique_id "acLCHKS8TU_xcQFvlnb8ggAAAAM"]
[Wed Mar 25 00:55:56.570934 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59118] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ad.php"] [unique_id "acLCHA0pGUh6bwD3ouKHiAAAANE"]
[Wed Mar 25 00:55:57.091528 2026] [:error] [pid 57703:tid 58038] [client 158.158.111.117:60248] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ad.php"] [unique_id "acLCHfIVQxDtjkklWGZTGQAAAFM"]
[Wed Mar 25 00:55:57.574461 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:60270] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ad.php"] [unique_id "acLCHfIVQxDtjkklWGZTHQAAAFI"]
[Wed Mar 25 00:55:58.215679 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:61568] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ad.php"] [unique_id "acLCHqLdPFdeRRktTdNTsQAAAJE"]
[Wed Mar 25 00:55:58.757646 2026] [:error] [pid 57711:tid 58076] [client 158.158.111.117:60240] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "acLCHqLdPFdeRRktTdNTtwAAAJY"]
[Wed Mar 25 00:55:59.308091 2026] [:error] [pid 57703:tid 58024] [client 158.158.111.117:60302] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "acLCH_IVQxDtjkklWGZTIgAAAEU"]
[Wed Mar 25 00:55:59.995678 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:60970] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "acLCH-b25OL4yTv2fF9unwAAARE"]
[Wed Mar 25 00:56:00.621134 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:60905] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/manager.php"] [unique_id "acLCIPIVQxDtjkklWGZTKwAAAEs"]
[Wed Mar 25 00:56:01.350829 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:58116] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acLCIeb25OL4yTv2fF9urQAAARg"]
[Wed Mar 25 00:56:01.851437 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:59681] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acLCIaLdPFdeRRktTdNTxwAAAIQ"]
[Wed Mar 25 00:56:02.525442 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:60939] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acLCIub25OL4yTv2fF9utAAAAQ0"]
[Wed Mar 25 00:56:03.257171 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:61561] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acLCIw0pGUh6bwD3ouKHnwAAAMk"]
[Wed Mar 25 00:56:03.834233 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:61616] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geger.php"] [unique_id "acLCIw0pGUh6bwD3ouKHowAAANQ"]
[Wed Mar 25 00:56:04.367310 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:60273] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geger.php"] [unique_id "acLCJOb25OL4yTv2fF9uvgAAAQo"]
[Wed Mar 25 00:56:04.987865 2026] [:error] [pid 57703:tid 58033] [client 158.158.111.117:59077] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geger.php"] [unique_id "acLCJPIVQxDtjkklWGZTNgAAAE4"]
[Wed Mar 25 00:56:05.496061 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:60978] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/geger.php"] [unique_id "acLCJaS8TU_xcQFvlnb8iwAAAAY"]
[Wed Mar 25 00:56:06.005210 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60258] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acLCJg0pGUh6bwD3ouKHrgAAANY"]
[Wed Mar 25 00:56:06.550163 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:56396] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acLCJub25OL4yTv2fF9uyAAAAQs"]
[Wed Mar 25 00:56:07.054363 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59773] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acLCJw0pGUh6bwD3ouKHsQAAAMI"]
[Wed Mar 25 00:56:07.613307 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:60225] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acLCJw0pGUh6bwD3ouKHtAAAANM"]
[Wed Mar 25 00:56:08.158727 2026] [:error] [pid 57703:tid 58028] [client 158.158.111.117:60908] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gi.php"] [unique_id "acLCKPIVQxDtjkklWGZTPQAAAEk"]
[Wed Mar 25 00:56:08.699289 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:56843] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gi.php"] [unique_id "acLCKA0pGUh6bwD3ouKHugAAANQ"]
[Wed Mar 25 00:56:09.260630 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:61605] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gi.php"] [unique_id "acLCKQ0pGUh6bwD3ouKHvwAAAMo"]
[Wed Mar 25 00:56:09.758507 2026] [:error] [pid 57702:tid 57918] [client 158.158.111.117:60306] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gi.php"] [unique_id "acLCKaS8TU_xcQFvlnb8kwAAAA8"]
[Wed Mar 25 00:56:10.250325 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:59721] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "acLCKqS8TU_xcQFvlnb8lgAAABA"]
[Wed Mar 25 00:56:11.131161 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:59104] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "acLCKw0pGUh6bwD3ouKHyAAAAMU"]
[Wed Mar 25 00:56:11.655717 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60321] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "acLCK-b25OL4yTv2fF9u4wAAARI"]
[Wed Mar 25 00:56:12.156816 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:60883] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "acLCLOb25OL4yTv2fF9u6AAAARU"]
[Wed Mar 25 00:56:12.690198 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59088] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuwno.php"] [unique_id "acLCLOb25OL4yTv2fF9u7wAAAQo"]
[Wed Mar 25 00:56:13.197803 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:61630] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuwno.php"] [unique_id "acLCLeb25OL4yTv2fF9u9AAAAQg"]
[Wed Mar 25 00:56:13.687552 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:60326] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuwno.php"] [unique_id "acLCLeb25OL4yTv2fF9u9wAAARM"]
[Wed Mar 25 00:56:14.231179 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:58192] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuwno.php"] [unique_id "acLCLub25OL4yTv2fF9u_gAAAQk"]
[Wed Mar 25 00:56:14.828108 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60894] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-user.php"] [unique_id "acLCLub25OL4yTv2fF9vBQAAAQc"]
[Wed Mar 25 00:56:15.350869 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:61599] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-user.php"] [unique_id "acLCLw0pGUh6bwD3ouKH2QAAAMk"]
[Wed Mar 25 00:56:15.847214 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:59738] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-user.php"] [unique_id "acLCL-b25OL4yTv2fF9vDgAAAQ0"]
[Wed Mar 25 00:56:16.403145 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:60866] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-user.php"] [unique_id "acLCMOb25OL4yTv2fF9vFwAAAQM"]
[Wed Mar 25 00:56:16.975527 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:61567] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws29.php"] [unique_id "acLCMOb25OL4yTv2fF9vHAAAARc"]
[Wed Mar 25 00:56:17.588869 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:59079] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws29.php"] [unique_id "acLCMeb25OL4yTv2fF9vIQAAARY"]
[Wed Mar 25 00:56:18.211401 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:60913] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws29.php"] [unique_id "acLCMqS8TU_xcQFvlnb8sAAAAAg"]
[Wed Mar 25 00:56:18.704697 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:59066] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws29.php"] [unique_id "acLCMub25OL4yTv2fF9vKwAAARQ"]
[Wed Mar 25 00:56:20.139714 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:59650] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acLCNPIVQxDtjkklWGZTRAAAAEE"]
[Wed Mar 25 00:56:20.862321 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:57612] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acLCNA0pGUh6bwD3ouKH5gAAANI"]
[Wed Mar 25 00:56:21.424251 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59686] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acLCNeb25OL4yTv2fF9vPQAAAQY"]
[Wed Mar 25 00:56:21.995805 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59770] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acLCNQ0pGUh6bwD3ouKH5wAAAMI"]
[Wed Mar 25 00:56:22.501611 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60237] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fc72f.php"] [unique_id "acLCNg0pGUh6bwD3ouKH6gAAAMM"]
[Wed Mar 25 00:56:23.117551 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:59752] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fc72f.php"] [unique_id "acLCN6S8TU_xcQFvlnb8uQAAAAs"]
[Wed Mar 25 00:56:23.768765 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:61519] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fc72f.php"] [unique_id "acLCNw0pGUh6bwD3ouKH7gAAAM0"]
[Wed Mar 25 00:56:24.259744 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:60348] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fc72f.php"] [unique_id "acLCOOb25OL4yTv2fF9vTgAAAQg"]
[Wed Mar 25 00:56:24.804081 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:60912] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qhLaGswd9DS.php"] [unique_id "acLCOOb25OL4yTv2fF9vVQAAARg"]
[Wed Mar 25 00:56:25.303507 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60935] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qhLaGswd9DS.php"] [unique_id "acLCOeb25OL4yTv2fF9vXQAAAQ8"]
[Wed Mar 25 00:56:25.814434 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:60340] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qhLaGswd9DS.php"] [unique_id "acLCOeb25OL4yTv2fF9vZQAAAQY"]
[Wed Mar 25 00:56:26.338917 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:61617] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qhLaGswd9DS.php"] [unique_id "acLCOub25OL4yTv2fF9vbQAAAQc"]
[Wed Mar 25 00:56:26.875946 2026] [:error] [pid 57702:tid 57907] [client 158.158.111.117:60911] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ac.php"] [unique_id "acLCOqS8TU_xcQFvlnb8vAAAAAQ"]
[Wed Mar 25 00:56:27.390687 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:61552] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ac.php"] [unique_id "acLCO6S8TU_xcQFvlnb8vQAAAA4"]
[Wed Mar 25 00:56:27.985366 2026] [:error] [pid 57703:tid 58035] [client 158.158.111.117:60987] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ac.php"] [unique_id "acLCO_IVQxDtjkklWGZTTwAAAFA"]
[Wed Mar 25 00:56:28.480444 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:57715] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-ac.php"] [unique_id "acLCPKS8TU_xcQFvlnb8wgAAAAg"]
[Wed Mar 25 00:56:29.020649 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:61604] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kao.php"] [unique_id "acLCPaLdPFdeRRktTdNT9gAAAIw"]
[Wed Mar 25 00:56:29.572884 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:60864] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kao.php"] [unique_id "acLCPaLdPFdeRRktTdNT-QAAAJc"]
[Wed Mar 25 00:56:30.154179 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:59021] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kao.php"] [unique_id "acLCPqLdPFdeRRktTdNT_AAAAIA"]
[Wed Mar 25 00:56:30.700532 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:59766] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kao.php"] [unique_id "acLCPqLdPFdeRRktTdNT_wAAAI0"]
[Wed Mar 25 00:56:31.222666 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:60228] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acLCP6LdPFdeRRktTdNUAwAAAIU"]
[Wed Mar 25 00:56:31.725496 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:60293] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acLCPw0pGUh6bwD3ouKH8wAAANc"]
[Wed Mar 25 00:56:32.371204 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:60923] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acLCQOb25OL4yTv2fF9vjwAAAQI"]
[Wed Mar 25 00:56:34.001757 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:60263] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acLCQg0pGUh6bwD3ouKH-wAAANE"]
[Wed Mar 25 00:57:00.399152 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:60317] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/boutj.php"] [unique_id "acLCXA0pGUh6bwD3ouKIMgAAANg"]
[Wed Mar 25 00:57:00.907917 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:60977] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/boutj.php"] [unique_id "acLCXOb25OL4yTv2fF9vzQAAAQU"]
[Wed Mar 25 00:57:01.441972 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59717] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/boutj.php"] [unique_id "acLCXQ0pGUh6bwD3ouKINAAAAMM"]
[Wed Mar 25 00:57:01.983181 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:60241] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/boutj.php"] [unique_id "acLCXeb25OL4yTv2fF9vzgAAARc"]
[Wed Mar 25 00:57:02.471168 2026] [:error] [pid 57703:tid 58038] [client 158.158.111.117:59677] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/04.php"] [unique_id "acLCXvIVQxDtjkklWGZTggAAAFM"]
[Wed Mar 25 00:57:03.019410 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:59757] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/04.php"] [unique_id "acLCX_IVQxDtjkklWGZTgwAAAFE"]
[Wed Mar 25 00:57:03.544699 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:59760] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/04.php"] [unique_id "acLCX6LdPFdeRRktTdNUGgAAAIo"]
[Wed Mar 25 00:57:04.097485 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60281] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/04.php"] [unique_id "acLCYA0pGUh6bwD3ouKIOwAAANA"]
[Wed Mar 25 00:57:04.603026 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59674] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xzourt.php"] [unique_id "acLCYA0pGUh6bwD3ouKIPwAAANE"]
[Wed Mar 25 00:57:05.174673 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:59712] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xzourt.php"] [unique_id "acLCYQ0pGUh6bwD3ouKIQwAAANg"]
[Wed Mar 25 00:57:05.660895 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:57618] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xzourt.php"] [unique_id "acLCYQ0pGUh6bwD3ouKIRwAAANY"]
[Wed Mar 25 00:57:06.230861 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60897] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xzourt.php"] [unique_id "acLCYqLdPFdeRRktTdNUHwAAAII"]
[Wed Mar 25 00:57:06.733746 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:61512] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vbbn.php"] [unique_id "acLCYqLdPFdeRRktTdNUIAAAAJc"]
[Wed Mar 25 00:57:07.232099 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:59037] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vbbn.php"] [unique_id "acLCY-b25OL4yTv2fF9v0wAAARM"]
[Wed Mar 25 00:57:07.717494 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60990] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vbbn.php"] [unique_id "acLCY-b25OL4yTv2fF9v1QAAAQc"]
[Wed Mar 25 00:57:08.343407 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:58131] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vbbn.php"] [unique_id "acLCZOb25OL4yTv2fF9v2QAAAQ4"]
[Wed Mar 25 00:57:08.831735 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:61615] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sang.php"] [unique_id "acLCZA0pGUh6bwD3ouKITQAAANE"]
[Wed Mar 25 00:57:09.341642 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:57624] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sang.php"] [unique_id "acLCZeb25OL4yTv2fF9v3AAAARA"]
[Wed Mar 25 00:57:09.849391 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:59670] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sang.php"] [unique_id "acLCZeb25OL4yTv2fF9v3gAAARg"]
[Wed Mar 25 00:57:10.347170 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:59687] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sang.php"] [unique_id "acLCZub25OL4yTv2fF9v4AAAARY"]
[Wed Mar 25 00:57:10.878880 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:59105] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wolv.php"] [unique_id "acLCZub25OL4yTv2fF9v4wAAAQI"]
[Wed Mar 25 00:57:11.433506 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:61624] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wolv.php"] [unique_id "acLCZ-b25OL4yTv2fF9v5gAAARI"]
[Wed Mar 25 00:57:11.983913 2026] [:error] [pid 57703:tid 58033] [client 158.158.111.117:60898] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wolv.php"] [unique_id "acLCZ_IVQxDtjkklWGZTiQAAAE4"]
[Wed Mar 25 00:57:12.502549 2026] [:error] [pid 57711:tid 58073] [client 158.158.111.117:58209] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wolv.php"] [unique_id "acLCaKLdPFdeRRktTdNUKQAAAJM"]
[Wed Mar 25 00:57:13.052517 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59730] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "acLCaQ0pGUh6bwD3ouKIUAAAAMA"]
[Wed Mar 25 00:57:13.621549 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:60917] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "acLCafIVQxDtjkklWGZTjAAAAEA"]
[Wed Mar 25 00:57:14.163314 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60893] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "acLCag0pGUh6bwD3ouKIWAAAAMk"]
[Wed Mar 25 00:57:14.708607 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:58219] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lock.php"] [unique_id "acLCaub25OL4yTv2fF9v6wAAARU"]
[Wed Mar 25 00:57:15.296648 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:60307] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/minik.php"] [unique_id "acLCa-b25OL4yTv2fF9v7QAAAQU"]
[Wed Mar 25 00:57:15.837353 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:57676] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/minik.php"] [unique_id "acLCa-b25OL4yTv2fF9v7wAAAQI"]
[Wed Mar 25 00:57:16.332750 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:61618] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/minik.php"] [unique_id "acLCbOb25OL4yTv2fF9v8AAAAQQ"]
[Wed Mar 25 00:57:16.841262 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:58208] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/minik.php"] [unique_id "acLCbOb25OL4yTv2fF9v8gAAAQo"]
[Wed Mar 25 00:57:17.422526 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59726] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cwsd.php"] [unique_id "acLCbeb25OL4yTv2fF9v9AAAAQc"]
[Wed Mar 25 00:57:17.935711 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59673] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cwsd.php"] [unique_id "acLCbeb25OL4yTv2fF9v9wAAAQY"]
[Wed Mar 25 00:57:18.527285 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:60873] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cwsd.php"] [unique_id "acLCbg0pGUh6bwD3ouKIaQAAAMM"]
[Wed Mar 25 00:57:19.067036 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:58232] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cwsd.php"] [unique_id "acLCb-b25OL4yTv2fF9wAgAAAQQ"]
[Wed Mar 25 00:57:19.654838 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:59661] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wxdxn.php"] [unique_id "acLCbw0pGUh6bwD3ouKIagAAAMQ"]
[Wed Mar 25 00:57:20.251956 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59040] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wxdxn.php"] [unique_id "acLCcOb25OL4yTv2fF9wCwAAAQY"]
[Wed Mar 25 00:57:20.744418 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:60934] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wxdxn.php"] [unique_id "acLCcOb25OL4yTv2fF9wDgAAARA"]
[Wed Mar 25 00:57:21.266464 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:60948] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wxdxn.php"] [unique_id "acLCcaLdPFdeRRktTdNULQAAAIk"]
[Wed Mar 25 00:57:21.749540 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:59740] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "acLCcfIVQxDtjkklWGZTjgAAAEo"]
[Wed Mar 25 00:57:22.236482 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60346] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "acLCcqLdPFdeRRktTdNULwAAAII"]
[Wed Mar 25 00:57:22.878035 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:60322] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "acLCcub25OL4yTv2fF9wFQAAARY"]
[Wed Mar 25 00:57:23.371910 2026] [:error] [pid 20371:tid 20374] [client 158.158.111.117:58193] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/function.php"] [unique_id "acLCc-b25OL4yTv2fF9wGQAAAQE"]
[Wed Mar 25 00:57:23.856283 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60279] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acLCc-b25OL4yTv2fF9wGgAAAQA"]
[Wed Mar 25 00:57:24.389583 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:59101] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acLCdPIVQxDtjkklWGZTkgAAAEw"]
[Wed Mar 25 00:57:24.946174 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:58196] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acLCdOb25OL4yTv2fF9wHwAAAQ0"]
[Wed Mar 25 00:57:25.449404 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:60907] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bolt.php"] [unique_id "acLCdaLdPFdeRRktTdNUMwAAAI0"]
[Wed Mar 25 00:57:26.010853 2026] [:error] [pid 57702:tid 57911] [client 158.158.111.117:59052] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "acLCdqS8TU_xcQFvlnb9BgAAAAg"]
[Wed Mar 25 00:57:26.612445 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59102] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "acLCdub25OL4yTv2fF9wIwAAAQQ"]
[Wed Mar 25 00:57:27.188009 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60300] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "acLCd-b25OL4yTv2fF9wKAAAARI"]
[Wed Mar 25 00:57:27.779162 2026] [:error] [pid 57703:tid 58025] [client 158.158.111.117:59719] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl.php"] [unique_id "acLCd_IVQxDtjkklWGZTlQAAAEY"]
[Wed Mar 25 00:57:28.339520 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:61530] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sikma.php"] [unique_id "acLCeKS8TU_xcQFvlnb9BwAAAAM"]
[Wed Mar 25 00:57:28.849233 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:58231] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sikma.php"] [unique_id "acLCeA0pGUh6bwD3ouKIbwAAAMk"]
[Wed Mar 25 00:57:29.488949 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:59724] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sikma.php"] [unique_id "acLCeQ0pGUh6bwD3ouKIcgAAAMg"]
[Wed Mar 25 00:57:30.026356 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60946] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sikma.php"] [unique_id "acLCeg0pGUh6bwD3ouKIdQAAAMA"]
[Wed Mar 25 00:57:30.617282 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:59771] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jjrpo.php"] [unique_id "acLCeqLdPFdeRRktTdNUOgAAAJQ"]
[Wed Mar 25 00:57:31.120705 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:59693] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jjrpo.php"] [unique_id "acLCe6LdPFdeRRktTdNUPAAAAJI"]
[Wed Mar 25 00:57:31.665012 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:59748] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jjrpo.php"] [unique_id "acLCe_IVQxDtjkklWGZTmwAAAFE"]
[Wed Mar 25 00:57:32.438332 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:60311] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jjrpo.php"] [unique_id "acLCfOb25OL4yTv2fF9wLQAAARg"]
[Wed Mar 25 00:57:33.088736 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:59678] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/waw.php"] [unique_id "acLCfeb25OL4yTv2fF9wLwAAAQ8"]
[Wed Mar 25 00:57:33.762564 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:61509] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/waw.php"] [unique_id "acLCfeb25OL4yTv2fF9wMAAAARY"]
[Wed Mar 25 00:57:34.363626 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:61564] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/waw.php"] [unique_id "acLCfqS8TU_xcQFvlnb9DwAAABA"]
[Wed Mar 25 00:57:34.952442 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:58210] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/waw.php"] [unique_id "acLCfub25OL4yTv2fF9wNgAAARU"]
[Wed Mar 25 00:57:35.473547 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:61528] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9D/wp.php"] [unique_id "acLCf-b25OL4yTv2fF9wOQAAAQ4"]
[Wed Mar 25 00:57:36.157940 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:60871] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9D/wp.php"] [unique_id "acLCgA0pGUh6bwD3ouKIegAAAMQ"]
[Wed Mar 25 00:57:36.684018 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60868] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9D/wp.php"] [unique_id "acLCgKS8TU_xcQFvlnb9FAAAAAs"]
[Wed Mar 25 00:57:37.230288 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:61596] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9D/wp.php"] [unique_id "acLCgaS8TU_xcQFvlnb9FgAAABE"]
[Wed Mar 25 00:57:37.724661 2026] [:error] [pid 57702:tid 57909] [client 158.158.111.117:59665] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acLCgaS8TU_xcQFvlnb9GQAAAAY"]
[Wed Mar 25 00:57:38.292080 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60972] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acLCgg0pGUh6bwD3ouKIgAAAANA"]
[Wed Mar 25 00:57:38.869075 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60340] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acLCgqS8TU_xcQFvlnb9GwAAAAM"]
[Wed Mar 25 00:57:39.386387 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:57668] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acLCg-b25OL4yTv2fF9wOwAAAQY"]
[Wed Mar 25 00:57:39.871276 2026] [:error] [pid 57703:tid 58042] [client 158.158.111.117:59756] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acLCg_IVQxDtjkklWGZTpAAAAFc"]
[Wed Mar 25 00:57:40.419983 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:61558] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/srx.php"] [unique_id "acLChOb25OL4yTv2fF9wPgAAARA"]
[Wed Mar 25 00:57:40.911379 2026] [:error] [pid 57702:tid 57916] [client 158.158.111.117:60243] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/srx.php"] [unique_id "acLChKS8TU_xcQFvlnb9HwAAAA0"]
[Wed Mar 25 00:57:41.451541 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:60250] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/srx.php"] [unique_id "acLCheb25OL4yTv2fF9wQAAAAQI"]
[Wed Mar 25 00:57:41.981307 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59705] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/srx.php"] [unique_id "acLCheb25OL4yTv2fF9wQgAAAQc"]
[Wed Mar 25 00:57:42.487191 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59067] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flap.php"] [unique_id "acLChub25OL4yTv2fF9wRAAAAQQ"]
[Wed Mar 25 00:57:43.057652 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:60950] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flap.php"] [unique_id "acLCh-b25OL4yTv2fF9wRQAAAQk"]
[Wed Mar 25 00:57:43.647756 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:58173] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flap.php"] [unique_id "acLCh-b25OL4yTv2fF9wSQAAARI"]
[Wed Mar 25 00:57:44.153581 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:59707] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flap.php"] [unique_id "acLCiA0pGUh6bwD3ouKIiwAAAMQ"]
[Wed Mar 25 00:57:44.680159 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:60315] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/l3gi0n.php"] [unique_id "acLCiKLdPFdeRRktTdNUPgAAAI8"]
[Wed Mar 25 00:57:45.207754 2026] [:error] [pid 20371:tid 20385] [client 158.158.111.117:60327] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/l3gi0n.php"] [unique_id "acLCieb25OL4yTv2fF9wTAAAAQw"]
[Wed Mar 25 00:57:45.737912 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:60962] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/l3gi0n.php"] [unique_id "acLCieb25OL4yTv2fF9wTQAAAQY"]
[Wed Mar 25 00:57:46.237811 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:58149] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/l3gi0n.php"] [unique_id "acLCiub25OL4yTv2fF9wTwAAAQ0"]
[Wed Mar 25 00:57:46.828225 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:60333] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/x.php"] [unique_id "acLCiub25OL4yTv2fF9wUgAAARQ"]
[Wed Mar 25 00:57:47.426222 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:59713] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/x.php"] [unique_id "acLCi-b25OL4yTv2fF9wVQAAARY"]
[Wed Mar 25 00:57:48.152729 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:60282] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/x.php"] [unique_id "acLCjOb25OL4yTv2fF9wWQAAARU"]
[Wed Mar 25 00:57:48.646787 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:61510] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/x.php"] [unique_id "acLCjKLdPFdeRRktTdNUQQAAAIc"]
[Wed Mar 25 00:57:49.213805 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:58200] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc3.php"] [unique_id "acLCjeb25OL4yTv2fF9wXAAAAQ4"]
[Wed Mar 25 00:57:49.737945 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:58224] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc3.php"] [unique_id "acLCjaLdPFdeRRktTdNURgAAAJE"]
[Wed Mar 25 00:57:50.427216 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:58135] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc3.php"] [unique_id "acLCjub25OL4yTv2fF9wYAAAAQY"]
[Wed Mar 25 00:57:51.046964 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:61590] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cc3.php"] [unique_id "acLCjw0pGUh6bwD3ouKIkQAAAMs"]
[Wed Mar 25 00:57:51.659280 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:61513] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hsx.php"] [unique_id "acLCjw0pGUh6bwD3ouKIkgAAAMY"]
[Wed Mar 25 00:57:52.191640 2026] [:error] [pid 57703:tid 58027] [client 158.158.111.117:60274] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hsx.php"] [unique_id "acLCkPIVQxDtjkklWGZTrQAAAEg"]
[Wed Mar 25 00:57:52.744841 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60339] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hsx.php"] [unique_id "acLCkA0pGUh6bwD3ouKIlAAAAM0"]
[Wed Mar 25 00:57:53.339769 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60288] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hsx.php"] [unique_id "acLCkeb25OL4yTv2fF9waAAAAQc"]
[Wed Mar 25 00:57:53.920901 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:59091] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acLCkQ0pGUh6bwD3ouKIlQAAAM4"]
[Wed Mar 25 00:57:54.483620 2026] [:error] [pid 20371:tid 20378] [client 158.158.111.117:61539] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acLCkub25OL4yTv2fF9wcwAAAQU"]
[Wed Mar 25 00:57:54.985692 2026] [:error] [pid 20371:tid 20385] [client 158.158.111.117:59108] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acLCkub25OL4yTv2fF9wdwAAAQw"]
[Wed Mar 25 00:57:55.475286 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:60959] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acLCk_IVQxDtjkklWGZTsgAAAFI"]
[Wed Mar 25 00:57:56.002965 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:59706] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs8.php"] [unique_id "acLClA0pGUh6bwD3ouKImQAAANM"]
[Wed Mar 25 00:57:56.651883 2026] [:error] [pid 57711:tid 58074] [client 158.158.111.117:60266] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs8.php"] [unique_id "acLClKLdPFdeRRktTdNUSQAAAJQ"]
[Wed Mar 25 00:57:57.134457 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:60963] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs8.php"] [unique_id "acLClaLdPFdeRRktTdNUSwAAAJI"]
[Wed Mar 25 00:57:57.714112 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:59749] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs8.php"] [unique_id "acLClaLdPFdeRRktTdNUTwAAAJA"]
[Wed Mar 25 00:57:58.209282 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:60287] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "acLClvIVQxDtjkklWGZTtwAAAFU"]
[Wed Mar 25 00:57:58.744096 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60261] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "acLClub25OL4yTv2fF9wgwAAAQA"]
[Wed Mar 25 00:58:19.628900 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:59772] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x/index.php"] [unique_id "acLCq_IVQxDtjkklWGZT3wAAAEo"]
[Wed Mar 25 00:58:20.279365 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:61505] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x/index.php"] [unique_id "acLCrOb25OL4yTv2fF9wwgAAAQY"]
[Wed Mar 25 00:58:20.845535 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:59121] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x/index.php"] [unique_id "acLCrOb25OL4yTv2fF9wxAAAAQs"]
[Wed Mar 25 00:58:21.382179 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:60242] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x/index.php"] [unique_id "acLCrQ0pGUh6bwD3ouKIpgAAAMQ"]
[Wed Mar 25 00:58:21.961583 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:59112] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0xs.php"] [unique_id "acLCrQ0pGUh6bwD3ouKIqAAAANE"]
[Wed Mar 25 00:58:22.514591 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:60251] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0xs.php"] [unique_id "acLCrqLdPFdeRRktTdNUXwAAAIs"]
[Wed Mar 25 00:58:23.066508 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:60342] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0xs.php"] [unique_id "acLCrw0pGUh6bwD3ouKIrQAAAMI"]
[Wed Mar 25 00:58:23.597254 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:59023] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0xs.php"] [unique_id "acLCrw0pGUh6bwD3ouKIsQAAANA"]
[Wed Mar 25 00:58:24.209105 2026] [:error] [pid 57711:tid 58062] [client 158.158.111.117:60305] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm18.php"] [unique_id "acLCsKLdPFdeRRktTdNUYAAAAIk"]
[Wed Mar 25 00:58:24.728618 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:60232] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm18.php"] [unique_id "acLCsKLdPFdeRRktTdNUYgAAAIc"]
[Wed Mar 25 00:58:25.279624 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:60335] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm18.php"] [unique_id "acLCsaLdPFdeRRktTdNUZAAAAJc"]
[Wed Mar 25 00:58:25.798263 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:60285] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lm18.php"] [unique_id "acLCsaS8TU_xcQFvlnb9XwAAABU"]
[Wed Mar 25 00:58:26.411392 2026] [:error] [pid 57702:tid 57925] [client 158.158.111.117:61573] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/accesson1.php"] [unique_id "acLCsqS8TU_xcQFvlnb9YwAAABY"]
[Wed Mar 25 00:58:26.904140 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:60262] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/accesson1.php"] [unique_id "acLCsg0pGUh6bwD3ouKIvQAAANE"]
[Wed Mar 25 00:58:27.479058 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:57633] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/accesson1.php"] [unique_id "acLCs6S8TU_xcQFvlnb9ZwAAABg"]
[Wed Mar 25 00:58:28.059636 2026] [:error] [pid 57703:tid 58038] [client 158.158.111.117:60310] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/accesson1.php"] [unique_id "acLCtPIVQxDtjkklWGZT5QAAAFM"]
[Wed Mar 25 00:58:28.667443 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60332] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "acLCtKS8TU_xcQFvlnb9cAAAAAs"]
[Wed Mar 25 00:58:29.152154 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:59753] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "acLCtaLdPFdeRRktTdNUbAAAAJA"]
[Wed Mar 25 00:58:29.657164 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60278] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "acLCtQ0pGUh6bwD3ouKIxAAAAMk"]
[Wed Mar 25 00:58:30.184648 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:60880] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "acLCtg0pGUh6bwD3ouKIxgAAANg"]
[Wed Mar 25 00:58:30.685858 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:58134] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/to.php"] [unique_id "acLCtg0pGUh6bwD3ouKIyQAAAM4"]
[Wed Mar 25 00:58:31.267670 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:60898] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/to.php"] [unique_id "acLCtw0pGUh6bwD3ouKIzQAAANU"]
[Wed Mar 25 00:58:31.872712 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:60318] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/to.php"] [unique_id "acLCtw0pGUh6bwD3ouKI0gAAAME"]
[Wed Mar 25 00:58:32.366200 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60329] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/to.php"] [unique_id "acLCuA0pGUh6bwD3ouKI1QAAANY"]
[Wed Mar 25 00:58:32.925690 2026] [:error] [pid 57702:tid 57917] [client 158.158.111.117:59690] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-74mt77k.php"] [unique_id "acLCuKS8TU_xcQFvlnb9dgAAAA4"]
[Wed Mar 25 00:58:33.439872 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:60945] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-74mt77k.php"] [unique_id "acLCuQ0pGUh6bwD3ouKI2AAAAMs"]
[Wed Mar 25 00:58:33.939440 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:59739] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-74mt77k.php"] [unique_id "acLCueb25OL4yTv2fF9wygAAAQA"]
[Wed Mar 25 00:58:34.490147 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60926] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-74mt77k.php"] [unique_id "acLCug0pGUh6bwD3ouKI3AAAANI"]
[Wed Mar 25 00:58:35.010667 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59654] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/__1975.php"] [unique_id "acLCuw0pGUh6bwD3ouKI3gAAAM0"]
[Wed Mar 25 00:58:35.565325 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:57702] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/__1975.php"] [unique_id "acLCu-b25OL4yTv2fF9wzAAAAQs"]
[Wed Mar 25 00:58:36.089943 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:61572] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/__1975.php"] [unique_id "acLCvA0pGUh6bwD3ouKI4QAAAME"]
[Wed Mar 25 00:58:36.641848 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:61609] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/__1975.php"] [unique_id "acLCvOb25OL4yTv2fF9w0wAAARQ"]
[Wed Mar 25 00:58:37.182935 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:61521] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amniotic.php"] [unique_id "acLCvQ0pGUh6bwD3ouKI4wAAANY"]
[Wed Mar 25 00:58:37.709648 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:60294] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amniotic.php"] [unique_id "acLCvQ0pGUh6bwD3ouKI5QAAAMQ"]
[Wed Mar 25 00:58:38.267562 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60343] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amniotic.php"] [unique_id "acLCvg0pGUh6bwD3ouKI5wAAAMY"]
[Wed Mar 25 00:58:38.838280 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:60916] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amniotic.php"] [unique_id "acLCvg0pGUh6bwD3ouKI7AAAANE"]
[Wed Mar 25 00:58:39.349907 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59072] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-xml.php"] [unique_id "acLCvw0pGUh6bwD3ouKI7gAAAMM"]
[Wed Mar 25 00:58:39.889651 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:59095] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-xml.php"] [unique_id "acLCv6S8TU_xcQFvlnb9hAAAABU"]
[Wed Mar 25 00:58:40.399883 2026] [:error] [pid 57702:tid 57915] [client 158.158.111.117:60301] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-xml.php"] [unique_id "acLCwKS8TU_xcQFvlnb9iQAAAAw"]
[Wed Mar 25 00:58:40.929834 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:61515] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-xml.php"] [unique_id "acLCwA0pGUh6bwD3ouKI9AAAAMY"]
[Wed Mar 25 00:58:41.540018 2026] [:error] [pid 58154:tid 58181] [client 158.158.111.117:59775] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d4.php"] [unique_id "acLCwQ0pGUh6bwD3ouKI-QAAANg"]
[Wed Mar 25 00:58:42.117758 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:61525] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d4.php"] [unique_id "acLCwub25OL4yTv2fF9w1QAAAQM"]
[Wed Mar 25 00:58:42.654698 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:60887] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d4.php"] [unique_id "acLCwg0pGUh6bwD3ouKI_QAAANU"]
[Wed Mar 25 00:58:43.186674 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:58119] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d4.php"] [unique_id "acLCw-b25OL4yTv2fF9w1wAAAQo"]
[Wed Mar 25 00:58:43.672822 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:59769] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "acLCww0pGUh6bwD3ouKI_wAAANY"]
[Wed Mar 25 00:58:44.191778 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60906] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/just2.php"] [unique_id "acLCxA0pGUh6bwD3ouKJAAAAAMY"]
[Wed Mar 25 00:58:44.679370 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:56935] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/just2.php"] [unique_id "acLCxOb25OL4yTv2fF9w3gAAAQY"]
[Wed Mar 25 00:58:45.201448 2026] [:error] [pid 20371:tid 20376] [client 158.158.111.117:57613] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/just2.php"] [unique_id "acLCxeb25OL4yTv2fF9w5gAAAQM"]
[Wed Mar 25 00:58:45.722390 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:57631] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/just2.php"] [unique_id "acLCxeb25OL4yTv2fF9w6AAAARA"]
[Wed Mar 25 00:58:46.246532 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59731] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/slsqc.php"] [unique_id "acLCxub25OL4yTv2fF9w6QAAAQY"]
[Wed Mar 25 00:58:46.805661 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:59734] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/slsqc.php"] [unique_id "acLCxg0pGUh6bwD3ouKJAQAAANQ"]
[Wed Mar 25 00:58:47.332518 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:59741] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/slsqc.php"] [unique_id "acLCxw0pGUh6bwD3ouKJBAAAANU"]
[Wed Mar 25 00:58:47.878884 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:61629] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/slsqc.php"] [unique_id "acLCx_IVQxDtjkklWGZT7AAAAEo"]
[Wed Mar 25 00:58:48.364377 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59745] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spip.php"] [unique_id "acLCyOb25OL4yTv2fF9w8QAAAQo"]
[Wed Mar 25 00:58:48.972602 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:56900] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spip.php"] [unique_id "acLCyA0pGUh6bwD3ouKJCAAAAMQ"]
[Wed Mar 25 00:58:49.505028 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:60336] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spip.php"] [unique_id "acLCyeb25OL4yTv2fF9w-AAAARE"]
[Wed Mar 25 00:58:50.028278 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59063] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/spip.php"] [unique_id "acLCyub25OL4yTv2fF9w-gAAAQc"]
[Wed Mar 25 00:58:50.580594 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:60975] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gel4y.php"] [unique_id "acLCyub25OL4yTv2fF9w-wAAAQk"]
[Wed Mar 25 00:58:51.088619 2026] [:error] [pid 57702:tid 57905] [client 158.158.111.117:59669] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gel4y.php"] [unique_id "acLCy6S8TU_xcQFvlnb9pQAAAAI"]
[Wed Mar 25 00:58:51.612708 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59764] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gel4y.php"] [unique_id "acLCy-b25OL4yTv2fF9w_wAAAQo"]
[Wed Mar 25 00:58:52.259368 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:60297] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gel4y.php"] [unique_id "acLCzOb25OL4yTv2fF9xAQAAAQ8"]
[Wed Mar 25 00:58:52.833920 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:59087] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/heh.php"] [unique_id "acLCzKLdPFdeRRktTdNUcgAAAIc"]
[Wed Mar 25 00:58:53.317740 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60979] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/heh.php"] [unique_id "acLCzaS8TU_xcQFvlnb9qAAAAAs"]
[Wed Mar 25 00:58:53.808838 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60295] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/heh.php"] [unique_id "acLCzQ0pGUh6bwD3ouKJDAAAAMk"]
[Wed Mar 25 00:58:54.374960 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:59675] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/heh.php"] [unique_id "acLCzg0pGUh6bwD3ouKJEAAAAMc"]
[Wed Mar 25 00:58:54.931013 2026] [:error] [pid 57711:tid 58080] [client 158.158.111.117:59729] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "acLCzqLdPFdeRRktTdNUdAAAAJg"]
[Wed Mar 25 00:58:55.768306 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:59038] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-wlx.php"] [unique_id "acLCz6LdPFdeRRktTdNUeAAAAIU"]
[Wed Mar 25 00:58:56.312958 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:59031] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-wlx.php"] [unique_id "acLC0KLdPFdeRRktTdNUegAAAIQ"]
[Wed Mar 25 00:58:56.817354 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:59699] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-wlx.php"] [unique_id "acLC0A0pGUh6bwD3ouKJEwAAAME"]
[Wed Mar 25 00:58:57.343957 2026] [:error] [pid 57702:tid 57924] [client 158.158.111.117:59761] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-wlx.php"] [unique_id "acLC0aS8TU_xcQFvlnb9rAAAABU"]
[Wed Mar 25 00:58:57.832139 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:57705] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/frg.php"] [unique_id "acLC0aLdPFdeRRktTdNUfgAAAIw"]
[Wed Mar 25 00:58:58.351066 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:56430] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/frg.php"] [unique_id "acLC0qS8TU_xcQFvlnb9rwAAAAU"]
[Wed Mar 25 00:58:58.847641 2026] [:error] [pid 57703:tid 58021] [client 158.158.111.117:60245] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/frg.php"] [unique_id "acLC0vIVQxDtjkklWGZT8QAAAEI"]
[Wed Mar 25 00:58:59.380577 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:58186] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/frg.php"] [unique_id "acLC06LdPFdeRRktTdNUgQAAAIs"]
[Wed Mar 25 00:58:59.890198 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:60230] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aku.php"] [unique_id "acLC0_IVQxDtjkklWGZT8gAAAEM"]
[Wed Mar 25 00:59:00.435618 2026] [:error] [pid 57711:tid 58071] [client 158.158.111.117:59715] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aku.php"] [unique_id "acLC1KLdPFdeRRktTdNUhAAAAJE"]
[Wed Mar 25 00:59:01.015663 2026] [:error] [pid 57703:tid 58024] [client 158.158.111.117:59759] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aku.php"] [unique_id "acLC1fIVQxDtjkklWGZT8wAAAEU"]
[Wed Mar 25 00:59:01.565013 2026] [:error] [pid 57711:tid 58058] [client 158.158.111.117:60313] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aku.php"] [unique_id "acLC1aLdPFdeRRktTdNUhwAAAIY"]
[Wed Mar 25 00:59:02.147337 2026] [:error] [pid 57703:tid 58037] [client 158.158.111.117:60246] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ctex1.php"] [unique_id "acLC1vIVQxDtjkklWGZT9gAAAFI"]
[Wed Mar 25 00:59:02.671407 2026] [:error] [pid 57703:tid 58020] [client 158.158.111.117:59017] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ctex1.php"] [unique_id "acLC1vIVQxDtjkklWGZT-AAAAEE"]
[Wed Mar 25 00:59:03.196709 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60900] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ctex1.php"] [unique_id "acLC1w0pGUh6bwD3ouKJIwAAAM0"]
[Wed Mar 25 00:59:03.725604 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:59746] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ctex1.php"] [unique_id "acLC1-b25OL4yTv2fF9xBwAAARc"]
[Wed Mar 25 00:59:04.253196 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:60980] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-front.php"] [unique_id "acLC2PIVQxDtjkklWGZT-wAAAEA"]
[Wed Mar 25 00:59:04.767869 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:60286] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-front.php"] [unique_id "acLC2KLdPFdeRRktTdNUiQAAAI0"]
[Wed Mar 25 00:59:05.417939 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:61534] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-front.php"] [unique_id "acLC2Q0pGUh6bwD3ouKJJwAAAMM"]
[Wed Mar 25 00:59:05.907551 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:60298] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-front.php"] [unique_id "acLC2eb25OL4yTv2fF9xCQAAAQ0"]
[Wed Mar 25 00:59:06.518486 2026] [:error] [pid 58154:tid 58175] [client 158.158.111.117:60304] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "acLC2g0pGUh6bwD3ouKJKwAAANI"]
[Wed Mar 25 00:59:07.217851 2026] [:error] [pid 58154:tid 58158] [client 158.158.111.117:59133] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "acLC2w0pGUh6bwD3ouKJLAAAAME"]
[Wed Mar 25 00:59:07.782657 2026] [:error] [pid 57703:tid 58029] [client 158.158.111.117:61601] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "acLC2_IVQxDtjkklWGZT_QAAAEo"]
[Wed Mar 25 00:59:08.621376 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:60290] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file1.php"] [unique_id "acLC3Ob25OL4yTv2fF9xGQAAAQc"]
[Wed Mar 25 00:59:09.134545 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:59722] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws35.php"] [unique_id "acLC3Q0pGUh6bwD3ouKJMAAAANM"]
[Wed Mar 25 00:59:09.639528 2026] [:error] [pid 20371:tid 20381] [client 158.158.111.117:59018] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws35.php"] [unique_id "acLC3eb25OL4yTv2fF9xIAAAAQg"]
[Wed Mar 25 00:59:10.240646 2026] [:error] [pid 20371:tid 20384] [client 158.158.111.117:58181] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws35.php"] [unique_id "acLC3ub25OL4yTv2fF9xJQAAAQs"]
[Wed Mar 25 00:59:10.779331 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59009] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws35.php"] [unique_id "acLC3g0pGUh6bwD3ouKJMQAAAMw"]
[Wed Mar 25 00:59:11.299973 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60890] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/XxX.php"] [unique_id "acLC3-b25OL4yTv2fF9xKQAAARI"]
[Wed Mar 25 00:59:11.901559 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:56915] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/XxX.php"] [unique_id "acLC3-b25OL4yTv2fF9xLQAAAQ8"]
[Wed Mar 25 00:59:12.397384 2026] [:error] [pid 58154:tid 58173] [client 158.158.111.117:60267] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/XxX.php"] [unique_id "acLC4A0pGUh6bwD3ouKJNAAAANA"]
[Wed Mar 25 00:59:12.942867 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:61516] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/XxX.php"] [unique_id "acLC4Ob25OL4yTv2fF9xMgAAAQI"]
[Wed Mar 25 00:59:13.456302 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:61574] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/litanies.php"] [unique_id "acLC4aS8TU_xcQFvlnb9tAAAABI"]
[Wed Mar 25 00:59:14.024675 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:59701] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/litanies.php"] [unique_id "acLC4ub25OL4yTv2fF9xNAAAAQ4"]
[Wed Mar 25 00:59:14.592186 2026] [:error] [pid 57703:tid 58022] [client 158.158.111.117:60229] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/litanies.php"] [unique_id "acLC4vIVQxDtjkklWGZUAAAAAEM"]
[Wed Mar 25 00:59:15.202767 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:59045] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/litanies.php"] [unique_id "acLC4-b25OL4yTv2fF9xNwAAAQ0"]
[Wed Mar 25 00:59:15.764275 2026] [:error] [pid 57703:tid 58032] [client 158.158.111.117:60869] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "acLC4_IVQxDtjkklWGZUAwAAAE0"]
[Wed Mar 25 00:59:16.287471 2026] [:error] [pid 58154:tid 58180] [client 158.158.111.117:61520] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "acLC5A0pGUh6bwD3ouKJNwAAANc"]
[Wed Mar 25 00:59:16.826167 2026] [:error] [pid 57702:tid 57913] [client 158.158.111.117:57653] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "acLC5KS8TU_xcQFvlnb9twAAAAo"]
[Wed Mar 25 00:59:17.439075 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:60330] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/about.php"] [unique_id "acLC5aLdPFdeRRktTdNUigAAAJA"]
[Wed Mar 25 00:59:33.435426 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:59716] [client 158.158.111.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "acLC9aLdPFdeRRktTdNUmwAAAIU"]
[Wed Mar 25 00:59:35.553316 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:59098] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "acLC9-b25OL4yTv2fF9xbwAAAQc"]
[Wed Mar 25 00:59:36.095183 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:61551] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "acLC-A0pGUh6bwD3ouKJSwAAAMI"]
[Wed Mar 25 00:59:36.641738 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60234] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "acLC-A0pGUh6bwD3ouKJTQAAAMc"]
[Wed Mar 25 00:59:37.297708 2026] [:error] [pid 20371:tid 20393] [client 158.158.111.117:61611] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "acLC-eb25OL4yTv2fF9xdgAAARQ"]
[Wed Mar 25 00:59:37.838754 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:59046] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lite.php"] [unique_id "acLC-eb25OL4yTv2fF9xeQAAAQ0"]
[Wed Mar 25 00:59:38.341693 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59750] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lite.php"] [unique_id "acLC-g0pGUh6bwD3ouKJUgAAAMM"]
[Wed Mar 25 00:59:38.842344 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:59071] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lite.php"] [unique_id "acLC-ub25OL4yTv2fF9xgAAAARc"]
[Wed Mar 25 00:59:39.440906 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:60319] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lite.php"] [unique_id "acLC--b25OL4yTv2fF9xhQAAAQI"]
[Wed Mar 25 00:59:40.068859 2026] [:error] [pid 20371:tid 20395] [client 158.158.111.117:61541] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qjaqjahu.php"] [unique_id "acLC_Ob25OL4yTv2fF9xiQAAARY"]
[Wed Mar 25 00:59:40.612850 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:58201] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qjaqjahu.php"] [unique_id "acLC_Ob25OL4yTv2fF9xiwAAAQ0"]
[Wed Mar 25 00:59:41.198147 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60309] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qjaqjahu.php"] [unique_id "acLC_eb25OL4yTv2fF9xjAAAAQA"]
[Wed Mar 25 00:59:41.693365 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60260] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/qjaqjahu.php"] [unique_id "acLC_eb25OL4yTv2fF9xkAAAARI"]
[Wed Mar 25 00:59:42.221842 2026] [:error] [pid 58154:tid 58163] [client 158.158.111.117:60932] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acLC_g0pGUh6bwD3ouKJVAAAAMY"]
[Wed Mar 25 00:59:42.783937 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:59688] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acLC_ub25OL4yTv2fF9xlwAAARA"]
[Wed Mar 25 00:59:43.281333 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:56895] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acLC_-b25OL4yTv2fF9xmwAAAQc"]
[Wed Mar 25 00:59:43.783538 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:59652] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/b.php"] [unique_id "acLC_w0pGUh6bwD3ouKJVQAAAM0"]
[Wed Mar 25 00:59:44.396594 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:56434] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xrp.php"] [unique_id "acLDAKLdPFdeRRktTdNUnwAAAIw"]
[Wed Mar 25 00:59:44.959516 2026] [:error] [pid 58154:tid 58159] [client 158.158.111.117:59736] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xrp.php"] [unique_id "acLDAA0pGUh6bwD3ouKJWQAAAMI"]
[Wed Mar 25 00:59:45.450981 2026] [:error] [pid 20371:tid 20397] [client 158.158.111.117:61593] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xrp.php"] [unique_id "acLDAeb25OL4yTv2fF9xoAAAARg"]
[Wed Mar 25 00:59:46.034948 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:59762] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xrp.php"] [unique_id "acLDAg0pGUh6bwD3ouKJWwAAAMw"]
[Wed Mar 25 00:59:46.662129 2026] [:error] [pid 57711:tid 58060] [client 158.158.111.117:60888] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tnt.php"] [unique_id "acLDAqLdPFdeRRktTdNUoAAAAIg"]
[Wed Mar 25 00:59:47.154509 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:59116] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tnt.php"] [unique_id "acLDA-b25OL4yTv2fF9xpgAAAQA"]
[Wed Mar 25 00:59:47.703917 2026] [:error] [pid 57711:tid 58064] [client 158.158.111.117:59016] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tnt.php"] [unique_id "acLDA6LdPFdeRRktTdNUogAAAIs"]
[Wed Mar 25 00:59:48.246849 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:58168] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tnt.php"] [unique_id "acLDBA0pGUh6bwD3ouKJZQAAAMo"]
[Wed Mar 25 00:59:48.806392 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:61506] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "acLDBKLdPFdeRRktTdNUowAAAIo"]
[Wed Mar 25 00:59:49.298546 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:59036] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "acLDBeb25OL4yTv2fF9xqgAAARI"]
[Wed Mar 25 00:59:50.030897 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:61603] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "acLDBg0pGUh6bwD3ouKJagAAANY"]
[Wed Mar 25 00:59:51.216013 2026] [:error] [pid 57711:tid 58059] [client 158.158.111.117:60254] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "acLDB6LdPFdeRRktTdNUpAAAAIc"]
[Wed Mar 25 00:59:51.811947 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:58199] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ticket.php"] [unique_id "acLDB6LdPFdeRRktTdNUpwAAAIA"]
[Wed Mar 25 00:59:52.388761 2026] [:error] [pid 58154:tid 58168] [client 158.158.111.117:60989] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ticket.php"] [unique_id "acLDCA0pGUh6bwD3ouKJcgAAAMs"]
[Wed Mar 25 00:59:53.057392 2026] [:error] [pid 57711:tid 58072] [client 158.158.111.117:59041] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ticket.php"] [unique_id "acLDCaLdPFdeRRktTdNUqAAAAJI"]
[Wed Mar 25 00:59:53.575020 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60968] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ticket.php"] [unique_id "acLDCQ0pGUh6bwD3ouKJdgAAAMc"]
[Wed Mar 25 00:59:54.079951 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:59122] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acLDCg0pGUh6bwD3ouKJeAAAANM"]
[Wed Mar 25 00:59:54.614281 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60971] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acLDCg0pGUh6bwD3ouKJewAAANY"]
[Wed Mar 25 00:59:55.249020 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60927] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acLDCw0pGUh6bwD3ouKJfgAAAM0"]
[Wed Mar 25 00:59:55.829248 2026] [:error] [pid 58154:tid 58161] [client 158.158.111.117:59735] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acLDCw0pGUh6bwD3ouKJfwAAAMQ"]
[Wed Mar 25 00:59:56.410032 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:59728] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xboom.php"] [unique_id "acLDDOb25OL4yTv2fF9xtgAAARE"]
[Wed Mar 25 00:59:57.089317 2026] [:error] [pid 58154:tid 58177] [client 158.158.111.117:60884] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xboom.php"] [unique_id "acLDDQ0pGUh6bwD3ouKJggAAANQ"]
[Wed Mar 25 00:59:57.608955 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:56946] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xboom.php"] [unique_id "acLDDeb25OL4yTv2fF9xuQAAARM"]
[Wed Mar 25 00:59:58.160054 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:59034] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xboom.php"] [unique_id "acLDDqLdPFdeRRktTdNUqgAAAIE"]
[Wed Mar 25 00:59:58.696454 2026] [:error] [pid 58154:tid 58174] [client 158.158.111.117:58137] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "acLDDg0pGUh6bwD3ouKJhgAAANE"]
[Wed Mar 25 00:59:59.207596 2026] [:error] [pid 58154:tid 58169] [client 158.158.111.117:60922] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "acLDDw0pGUh6bwD3ouKJhwAAAMw"]
[Wed Mar 25 00:59:59.719865 2026] [:error] [pid 57703:tid 58035] [client 158.158.111.117:60324] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "acLDD_IVQxDtjkklWGZUGgAAAFA"]
[Wed Mar 25 01:00:00.219860 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:60910] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "acLDEA0pGUh6bwD3ouKJigAAAMA"]
[Wed Mar 25 01:00:00.707858 2026] [:error] [pid 58154:tid 58170] [client 158.158.111.117:60951] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gzak2w.php"] [unique_id "acLDEA0pGUh6bwD3ouKJjQAAAM0"]
[Wed Mar 25 01:00:01.208844 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:60920] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gzak2w.php"] [unique_id "acLDEeb25OL4yTv2fF9xwAAAAQA"]
[Wed Mar 25 01:00:01.700754 2026] [:error] [pid 57702:tid 57906] [client 158.158.111.117:60921] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gzak2w.php"] [unique_id "acLDEaS8TU_xcQFvlnb99QAAAAM"]
[Wed Mar 25 01:00:02.235180 2026] [:error] [pid 58154:tid 58160] [client 158.158.111.117:59056] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gzak2w.php"] [unique_id "acLDEg0pGUh6bwD3ouKJkwAAAMM"]
[Wed Mar 25 01:00:02.765308 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:56932] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "acLDEqS8TU_xcQFvlnb9-AAAABE"]
[Wed Mar 25 01:00:03.349720 2026] [:error] [pid 20371:tid 20380] [client 158.158.111.117:58143] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "acLDE-b25OL4yTv2fF9xwwAAAQc"]
[Wed Mar 25 01:00:03.872987 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:59100] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "acLDEw0pGUh6bwD3ouKJlgAAAMU"]
[Wed Mar 25 01:00:04.384633 2026] [:error] [pid 57711:tid 58056] [client 158.158.111.117:60919] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/w.php"] [unique_id "acLDFKLdPFdeRRktTdNUrAAAAIU"]
[Wed Mar 25 01:00:05.109175 2026] [:error] [pid 57711:tid 58067] [client 158.158.111.117:60896] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl2023.php"] [unique_id "acLDFaLdPFdeRRktTdNUrwAAAI0"]
[Wed Mar 25 01:00:05.701818 2026] [:error] [pid 57703:tid 58031] [client 158.158.111.117:60930] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl2023.php"] [unique_id "acLDFfIVQxDtjkklWGZUHwAAAEw"]
[Wed Mar 25 01:00:06.335598 2026] [:error] [pid 57711:tid 58070] [client 158.158.111.117:60961] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl2023.php"] [unique_id "acLDFqLdPFdeRRktTdNUsQAAAJA"]
[Wed Mar 25 01:00:06.836563 2026] [:error] [pid 58154:tid 58179] [client 158.158.111.117:60976] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xl2023.php"] [unique_id "acLDFg0pGUh6bwD3ouKJpAAAANY"]
[Wed Mar 25 01:00:07.451819 2026] [:error] [pid 58154:tid 58171] [client 158.158.111.117:59026] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpupex.php"] [unique_id "acLDFw0pGUh6bwD3ouKJqQAAAM4"]
[Wed Mar 25 01:00:08.075139 2026] [:error] [pid 57702:tid 57908] [client 158.158.111.117:60937] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpupex.php"] [unique_id "acLDGKS8TU_xcQFvlnb9-QAAAAU"]
[Wed Mar 25 01:00:08.680837 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:59069] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpupex.php"] [unique_id "acLDGA0pGUh6bwD3ouKJswAAAMo"]
[Wed Mar 25 01:00:09.203362 2026] [:error] [pid 57703:tid 58023] [client 158.158.111.117:60350] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wpupex.php"] [unique_id "acLDGfIVQxDtjkklWGZUJQAAAEQ"]
[Wed Mar 25 01:00:09.805885 2026] [:error] [pid 57703:tid 58028] [client 158.158.111.117:60247] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mhpglaje.php"] [unique_id "acLDGfIVQxDtjkklWGZUJwAAAEk"]
[Wed Mar 25 01:00:10.345501 2026] [:error] [pid 57703:tid 58019] [client 158.158.111.117:61606] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mhpglaje.php"] [unique_id "acLDGvIVQxDtjkklWGZUKwAAAEA"]
[Wed Mar 25 01:00:10.864623 2026] [:error] [pid 57703:tid 58025] [client 158.158.111.117:59113] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mhpglaje.php"] [unique_id "acLDGvIVQxDtjkklWGZULQAAAEY"]
[Wed Mar 25 01:00:11.402622 2026] [:error] [pid 57703:tid 58036] [client 158.158.111.117:59131] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mhpglaje.php"] [unique_id "acLDG_IVQxDtjkklWGZUMAAAAFE"]
[Wed Mar 25 01:00:12.015304 2026] [:error] [pid 58154:tid 58172] [client 158.158.111.117:58129] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bnn_.php"] [unique_id "acLDHA0pGUh6bwD3ouKJxAAAAM8"]
[Wed Mar 25 01:00:12.573745 2026] [:error] [pid 58154:tid 58176] [client 158.158.111.117:61578] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bnn_.php"] [unique_id "acLDHA0pGUh6bwD3ouKJyAAAANM"]
[Wed Mar 25 01:00:13.104380 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:60924] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bnn_.php"] [unique_id "acLDHQ0pGUh6bwD3ouKJzwAAAMU"]
[Wed Mar 25 01:00:13.675059 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:57677] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bnn_.php"] [unique_id "acLDHQ0pGUh6bwD3ouKJ0wAAAMg"]
[Wed Mar 25 01:00:14.227222 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:58164] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ch.php"] [unique_id "acLDHqS8TU_xcQFvlnb9_QAAABA"]
[Wed Mar 25 01:00:14.871508 2026] [:error] [pid 57711:tid 58052] [client 158.158.111.117:60901] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ch.php"] [unique_id "acLDHqLdPFdeRRktTdNUtAAAAII"]
[Wed Mar 25 01:00:15.494165 2026] [:error] [pid 57702:tid 57910] [client 158.158.111.117:60865] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ch.php"] [unique_id "acLDH6S8TU_xcQFvlnb9_gAAAAc"]
[Wed Mar 25 01:00:16.012163 2026] [:error] [pid 57702:tid 57927] [client 158.158.111.117:59075] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ch.php"] [unique_id "acLDIKS8TU_xcQFvlnb-AAAAABg"]
[Wed Mar 25 01:00:16.714477 2026] [:error] [pid 57711:tid 58051] [client 158.158.111.117:60952] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "acLDIKLdPFdeRRktTdNUvAAAAIE"]
[Wed Mar 25 01:00:17.383272 2026] [:error] [pid 58154:tid 58166] [client 158.158.111.117:60239] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "acLDIQ0pGUh6bwD3ouKJ6AAAAMk"]
[Wed Mar 25 01:00:18.065352 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:59088] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "acLDIub25OL4yTv2fF9x3gAAARE"]
[Wed Mar 25 01:00:18.652854 2026] [:error] [pid 20371:tid 20394] [client 158.158.111.117:58158] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "acLDIub25OL4yTv2fF9x4AAAARU"]
[Wed Mar 25 01:00:19.406459 2026] [:error] [pid 57702:tid 57922] [client 158.158.111.117:61626] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "acLDI6S8TU_xcQFvlnb-AwAAABM"]
[Wed Mar 25 01:00:20.331281 2026] [:error] [pid 58154:tid 58164] [client 158.158.111.117:60345] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "acLDJA0pGUh6bwD3ouKJ9AAAAMc"]
[Wed Mar 25 01:00:21.059889 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:59754] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "acLDJeb25OL4yTv2fF9x5AAAAQ4"]
[Wed Mar 25 01:00:21.884682 2026] [:error] [pid 20371:tid 20388] [client 158.158.111.117:61627] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "acLDJeb25OL4yTv2fF9x5QAAAQ8"]
[Wed Mar 25 01:00:22.751690 2026] [:error] [pid 57703:tid 58041] [client 158.158.111.117:61586] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfvul.php"] [unique_id "acLDJvIVQxDtjkklWGZUOQAAAFY"]
[Wed Mar 25 01:00:23.474767 2026] [:error] [pid 57711:tid 58069] [client 158.158.111.117:60252] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfvul.php"] [unique_id "acLDJ6LdPFdeRRktTdNUwwAAAI8"]
[Wed Mar 25 01:00:24.469493 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:59107] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfvul.php"] [unique_id "acLDKOb25OL4yTv2fF9x6QAAARA"]
[Wed Mar 25 01:00:25.504343 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59681] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sfvul.php"] [unique_id "acLDKeb25OL4yTv2fF9x7QAAAQQ"]
[Wed Mar 25 01:00:26.153249 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:61619] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/china.php"] [unique_id "acLDKub25OL4yTv2fF9x8QAAARI"]
[Wed Mar 25 01:00:27.073472 2026] [:error] [pid 20371:tid 20387] [client 158.158.111.117:60896] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/china.php"] [unique_id "acLDK-b25OL4yTv2fF9x9AAAAQ4"]
[Wed Mar 25 01:00:28.259802 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:61610] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/china.php"] [unique_id "acLDLKLdPFdeRRktTdNUxgAAAIo"]
[Wed Mar 25 01:00:29.429144 2026] [:error] [pid 57703:tid 58040] [client 158.158.111.117:60885] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/china.php"] [unique_id "acLDLfIVQxDtjkklWGZUPwAAAFU"]
[Wed Mar 25 01:00:30.157249 2026] [:error] [pid 20371:tid 20389] [client 158.158.111.117:56916] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acLDLub25OL4yTv2fF9x-AAAARA"]
[Wed Mar 25 01:00:31.172708 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:61605] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acLDL6S8TU_xcQFvlnb-DAAAABA"]
[Wed Mar 25 01:00:32.191894 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:61561] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acLDMOb25OL4yTv2fF9x-wAAAQA"]
[Wed Mar 25 01:00:32.895777 2026] [:error] [pid 57703:tid 58030] [client 158.158.111.117:59742] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acLDMPIVQxDtjkklWGZUQwAAAEs"]
[Wed Mar 25 01:00:33.603212 2026] [:error] [pid 58154:tid 58167] [client 158.158.111.117:60966] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp.php"] [unique_id "acLDMQ0pGUh6bwD3ouKKEAAAAMo"]
[Wed Mar 25 01:00:51.055958 2026] [:error] [pid 20371:tid 20392] [client 158.158.111.117:58171] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lts.php"] [unique_id "acLDQ-b25OL4yTv2fF9yJQAAARM"]
[Wed Mar 25 01:01:02.472905 2026] [:error] [pid 58154:tid 58178] [client 158.158.111.117:61614] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lts.php"] [unique_id "acLDTg0pGUh6bwD3ouKKLAAAANU"]
[Wed Mar 25 01:01:03.273081 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:58132] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lts.php"] [unique_id "acLDT-b25OL4yTv2fF9yQgAAAQ0"]
[Wed Mar 25 01:01:04.167948 2026] [:error] [pid 57711:tid 58055] [client 158.158.111.117:60269] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lts.php"] [unique_id "acLDUKLdPFdeRRktTdNU4wAAAIQ"]
[Wed Mar 25 01:01:04.695702 2026] [:error] [pid 20371:tid 20383] [client 158.158.111.117:59664] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ba/wpup.php"] [unique_id "acLDUOb25OL4yTv2fF9ySAAAAQo"]
[Wed Mar 25 01:01:05.424874 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:61549] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ba/wpup.php"] [unique_id "acLDUeb25OL4yTv2fF9yTQAAARc"]
[Wed Mar 25 01:01:05.966465 2026] [:error] [pid 20371:tid 20386] [client 158.158.111.117:61554] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ba/wpup.php"] [unique_id "acLDUeb25OL4yTv2fF9yUQAAAQ0"]
[Wed Mar 25 01:01:06.469840 2026] [:error] [pid 57711:tid 58066] [client 158.158.111.117:59648] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ba/wpup.php"] [unique_id "acLDUqLdPFdeRRktTdNU5QAAAIw"]
[Wed Mar 25 01:01:07.029774 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:57644] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ini.php"] [unique_id "acLDU-b25OL4yTv2fF9yVAAAAQA"]
[Wed Mar 25 01:01:07.569415 2026] [:error] [pid 57711:tid 58063] [client 158.158.111.117:60942] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ini.php"] [unique_id "acLDU6LdPFdeRRktTdNU6AAAAIo"]
[Wed Mar 25 01:01:08.210989 2026] [:error] [pid 20371:tid 20396] [client 158.158.111.117:61565] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ini.php"] [unique_id "acLDVOb25OL4yTv2fF9yWgAAARc"]
[Wed Mar 25 01:01:08.703371 2026] [:error] [pid 20371:tid 20391] [client 158.158.111.117:60981] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ini.php"] [unique_id "acLDVOb25OL4yTv2fF9yXAAAARI"]
[Wed Mar 25 01:01:09.326538 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:59119] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ruzus.php"] [unique_id "acLDVeb25OL4yTv2fF9yYAAAAQY"]
[Wed Mar 25 01:01:09.859873 2026] [:error] [pid 20371:tid 20373] [client 158.158.111.117:57707] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ruzus.php"] [unique_id "acLDVeb25OL4yTv2fF9yZAAAAQA"]
[Wed Mar 25 01:01:10.455011 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:60902] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ruzus.php"] [unique_id "acLDVub25OL4yTv2fF9yZwAAAQQ"]
[Wed Mar 25 01:01:11.167005 2026] [:error] [pid 20371:tid 20385] [client 158.158.111.117:60892] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ruzus.php"] [unique_id "acLDV-b25OL4yTv2fF9ybgAAAQw"]
[Wed Mar 25 01:01:11.736347 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60283] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "acLDV6S8TU_xcQFvlnb-QgAAAAs"]
[Wed Mar 25 01:01:12.228467 2026] [:error] [pid 58154:tid 58165] [client 158.158.111.117:61620] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "acLDWA0pGUh6bwD3ouKKMQAAAMg"]
[Wed Mar 25 01:01:12.735950 2026] [:error] [pid 57702:tid 57919] [client 158.158.111.117:61567] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "acLDWKS8TU_xcQFvlnb-SAAAABA"]
[Wed Mar 25 01:01:13.279933 2026] [:error] [pid 57702:tid 57920] [client 158.158.111.117:60923] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "acLDWaS8TU_xcQFvlnb-SgAAABE"]
[Wed Mar 25 01:01:13.819626 2026] [:error] [pid 57703:tid 58021] [client 158.158.111.117:57689] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xcre1.php"] [unique_id "acLDWfIVQxDtjkklWGZUWgAAAEI"]
[Wed Mar 25 01:01:14.307482 2026] [:error] [pid 57711:tid 58050] [client 158.158.111.117:58195] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xcre1.php"] [unique_id "acLDWqLdPFdeRRktTdNU7QAAAIA"]
[Wed Mar 25 01:01:14.810012 2026] [:error] [pid 57702:tid 57914] [client 158.158.111.117:60351] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xcre1.php"] [unique_id "acLDWqS8TU_xcQFvlnb-TgAAAAs"]
[Wed Mar 25 01:01:15.380264 2026] [:error] [pid 20371:tid 20375] [client 158.158.111.117:61504] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xcre1.php"] [unique_id "acLDW-b25OL4yTv2fF9yeAAAAQI"]
[Wed Mar 25 01:01:15.959294 2026] [:error] [pid 20371:tid 20377] [client 158.158.111.117:59068] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acLDW-b25OL4yTv2fF9yegAAAQQ"]
[Wed Mar 25 01:01:16.532964 2026] [:error] [pid 20371:tid 20379] [client 158.158.111.117:61523] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acLDXOb25OL4yTv2fF9yfAAAAQY"]
[Wed Mar 25 01:01:17.114063 2026] [:error] [pid 20371:tid 20390] [client 158.158.111.117:60938] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acLDXeb25OL4yTv2fF9yfQAAARE"]
[Wed Mar 25 01:01:17.610308 2026] [:error] [pid 20371:tid 20382] [client 158.158.111.117:59683] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acLDXeb25OL4yTv2fF9ygQAAAQk"]
[Wed Mar 25 01:01:18.174116 2026] [:error] [pid 58154:tid 58162] [client 158.158.111.117:59655] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hello.php"] [unique_id "acLDXg0pGUh6bwD3ouKKPAAAAMU"]
[Wed Mar 25 01:01:18.739609 2026] [:error] [pid 58154:tid 58157] [client 158.158.111.117:59685] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hello.php"] [unique_id "acLDXg0pGUh6bwD3ouKKPgAAAMA"]
[Wed Mar 25 01:01:19.256486 2026] [:error] [pid 57702:tid 57921] [client 158.158.111.117:57626] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hello.php"] [unique_id "acLDX6S8TU_xcQFvlnb-UgAAABI"]
[Wed Mar 25 01:01:19.831529 2026] [:error] [pid 57711:tid 58077] [client 158.158.111.117:60259] [client 158.158.111.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hello.php"] [unique_id "acLDX6LdPFdeRRktTdNU8AAAAJc"]
[Wed Mar 25 01:34:31.304820 2026] [:error] [pid 58154:tid 58168] [client 43.153.76.247:46060] [client 43.153.76.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acLLJw0pGUh6bwD3ouKaWQAAAMs"]
[Wed Mar 25 03:01:09.391124 2026] [:error] [pid 20371:tid 20390] [client 49.7.227.204:54512] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acLfdeb25OL4yTv2fF_AoAAAARE"]
[Wed Mar 25 05:34:32.836401 2026] [:error] [pid 47989:tid 48000] [client 148.72.173.218:52702] [client 148.72.173.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.173.218, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acMDaCWKdJMhIccROjlhNgAAAUk"]
[Wed Mar 25 05:34:32.836473 2026] [:error] [pid 47989:tid 48000] [client 148.72.173.218:52702] [client 148.72.173.218] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 148.72.173.218 on wp-login.php, counter = 62"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acMDaCWKdJMhIccROjlhNgAAAUk"]
[Wed Mar 25 06:05:02.657528 2026] [:error] [pid 47946:tid 47949] [client 94.55.229.180:23963] [client 94.55.229.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.55.229.180, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acMKjjipQTqBMSeKYhf37gAAAQE"]
[Wed Mar 25 11:20:37.297000 2026] [:error] [pid 26449:tid 26455] [client 185.223.152.34:58255] [client 185.223.152.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.34, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acNUhdpZ2T15NDqzAjEfAAAAAkI"]
[Wed Mar 25 12:07:33.914142 2026] [:error] [pid 25875:tid 25884] [client 193.19.109.105:49609] [client 193.19.109.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.105, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acNfhRJ38QkS3Nyfshx5dQAAAoM"]
[Wed Mar 25 14:19:56.563606 2026] [:error] [pid 47946:tid 47967] [client 122.168.80.73:21284] [client 122.168.80.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.80.73, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acN-jDipQTqBMSeKYhdtpwAAARM"]
[Wed Mar 25 15:22:31.689492 2026] [:error] [pid 892:tid 918] [client 101.33.80.42:41846] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acONNyT_G8WMU3T3yxqw7AAAANM"]
[Wed Mar 25 16:14:16.287929 2026] [:error] [pid 47989:tid 47995] [client 115.186.169.142:61252] [client 115.186.169.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.186.169.142, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acOZWCWKdJMhIccROjlp7wAAAUQ"]
[Wed Mar 25 16:14:25.859204 2026] [:error] [pid 25967:tid 25990] [client 98.159.37.240:50285] [client 98.159.37.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.240, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acOZYfg8Qtq7ZM4mSFkFHwAAA1I"]
[Wed Mar 25 17:04:13.337223 2026] [:error] [pid 26321:tid 26346] [client 106.54.62.156:45454] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acOlDfKO65qqGZCSPZojggAAAgY"]
[Wed Mar 25 17:56:57.837587 2026] [:error] [pid 756:tid 857] [client 43.153.26.165:60292] [client 43.153.26.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acOxaTOaW6oylMIDBCQYfQAAAIU"]
[Wed Mar 25 18:30:43.408411 2026] [:error] [pid 756:tid 869] [client 91.144.18.230:29445] [client 91.144.18.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.144.18.230, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acO5UzOaW6oylMIDBCQaqwAAAJE"]
[Wed Mar 25 18:38:49.678599 2026] [:error] [pid 47989:tid 47996] [client 51.103.250.122:45331] [client 51.103.250.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO7OSWKdJMhIccROjm1JgAAAUU"]
[Wed Mar 25 18:38:50.173808 2026] [:error] [pid 47989:tid 48002] [client 51.103.250.122:51137] [client 51.103.250.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO7OiWKdJMhIccROjm1KgAAAUs"]
[Wed Mar 25 18:38:50.648866 2026] [:error] [pid 25969:tid 26046] [client 51.103.250.122:53288] [client 51.103.250.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO7Ohd3aEUmOfdKja8DewAAA9Q"]
[Wed Mar 25 20:33:32.323568 2026] [:error] [pid 892:tid 918] [client 43.130.32.245:58026] [client 43.130.32.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acPWHCT_G8WMU3T3yxrYOgAAANM"]
[Wed Mar 25 20:38:07.625843 2026] [:error] [pid 25969:tid 26026] [client 4.223.157.191:13826] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acPXLxd3aEUmOfdKja8OzAAAA8A"]
[Wed Mar 25 21:09:54.295825 2026] [:error] [pid 47989:tid 48004] [client 185.223.152.39:53667] [client 185.223.152.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.39, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acPeoiWKdJMhIccROjn6pwAAAU0"]
[Wed Mar 25 22:46:06.430046 2026] [:error] [pid 25875:tid 25902] [client 44.203.144.232:35420] [client 44.203.144.232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||paramountestate.com|F|4"] [data "EmailWolf"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acP1LhJ38QkS3NyfshxLdwAAApU"]
[Wed Mar 25 23:08:45.334855 2026] [:error] [pid 25875:tid 25891] [client 170.106.73.216:55844] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acP6fRJ38QkS3NyfshxUBAAAAoo"]
[Thu Mar 26 00:59:28.371741 2026] [:error] [pid 56131:tid 56160] [client 101.42.46.71:59812] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acQUcEg5t1V4ZYPCUhwc7QAAABU"]
[Thu Mar 26 01:49:13.422073 2026] [:error] [pid 56131:tid 56139] [client 43.157.170.126:44560] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acQgGUg5t1V4ZYPCUhwvZQAAAAA"]
[Thu Mar 26 05:03:03.080739 2026] [:error] [pid 19818:tid 19825] [client 43.153.86.78:48012] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acRNh8zaSnm3d1BeM5UzoAAAAMU"]
[Thu Mar 26 05:22:23.564830 2026] [:error] [pid 19711:tid 19773] [client 20.215.253.210:24776] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acRSD2j3l1y81GYfluQVxwAAAFg"]
[Thu Mar 26 05:22:32.249718 2026] [:error] [pid 19818:tid 19829] [client 20.215.253.210:42021] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acRSGMzaSnm3d1BeM5U8ugAAAMk"]
[Thu Mar 26 05:22:32.961926 2026] [:error] [pid 19712:tid 19796] [client 20.215.253.210:24792] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acRSGNWhKhRNqm23vFOkigAAAJQ"]
[Thu Mar 26 05:22:33.531702 2026] [:error] [pid 19818:tid 19834] [client 20.215.253.210:24789] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acRSGczaSnm3d1BeM5U8vQAAAM4"]
[Thu Mar 26 05:22:34.230434 2026] [:error] [pid 19711:tid 19754] [client 20.215.253.210:24803] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acRSGmj3l1y81GYfluQV0QAAAEU"]
[Thu Mar 26 05:22:35.359371 2026] [:error] [pid 19818:tid 19836] [client 20.215.253.210:24781] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acRSG8zaSnm3d1BeM5U8zAAAANA"]
[Thu Mar 26 05:22:37.228778 2026] [:error] [pid 60829:tid 60831] [client 20.215.253.210:41989] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acRSHfTdjHKeZokybaS4CAAAAQA"]
[Thu Mar 26 05:22:39.173826 2026] [:error] [pid 19818:tid 19820] [client 20.215.253.210:24806] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "acRSH8zaSnm3d1BeM5U83AAAAMA"]
[Thu Mar 26 05:22:39.904166 2026] [:error] [pid 19712:tid 19784] [client 20.215.253.210:24785] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wen.php"] [unique_id "acRSH9WhKhRNqm23vFOklAAAAIg"]
[Thu Mar 26 05:22:40.427430 2026] [:error] [pid 19710:tid 19722] [client 20.215.253.210:41946] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wen.php"] [unique_id "acRSIAVEWP8Ar68Njk6ENwAAAAA"]
[Thu Mar 26 05:22:41.028341 2026] [:error] [pid 19712:tid 19790] [client 20.215.253.210:24809] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wen.php"] [unique_id "acRSIdWhKhRNqm23vFOklgAAAI4"]
[Thu Mar 26 05:22:41.622883 2026] [:error] [pid 19712:tid 19782] [client 20.215.253.210:24770] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wen.php"] [unique_id "acRSIdWhKhRNqm23vFOkmgAAAIY"]
[Thu Mar 26 05:22:43.177788 2026] [:error] [pid 19818:tid 19837] [client 20.215.253.210:42008] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acRSI8zaSnm3d1BeM5U84wAAANE"]
[Thu Mar 26 05:22:43.783253 2026] [:error] [pid 60829:tid 60837] [client 20.215.253.210:42014] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acRSI_TdjHKeZokybaS4LwAAAQY"]
[Thu Mar 26 05:22:44.370910 2026] [:error] [pid 60829:tid 60836] [client 20.215.253.210:24807] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acRSJPTdjHKeZokybaS4MwAAAQU"]
[Thu Mar 26 05:22:45.461706 2026] [:error] [pid 60829:tid 60849] [client 20.215.253.210:42038] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/init.php"] [unique_id "acRSJfTdjHKeZokybaS4NgAAARI"]
[Thu Mar 26 05:22:47.553773 2026] [:error] [pid 60829:tid 60855] [client 20.215.253.210:42015] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acRSJ_TdjHKeZokybaS4QgAAARg"]
[Thu Mar 26 05:22:48.358953 2026] [:error] [pid 60829:tid 60832] [client 20.215.253.210:42046] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acRSKPTdjHKeZokybaS4RQAAAQE"]
[Thu Mar 26 05:22:50.260805 2026] [:error] [pid 19711:tid 19758] [client 20.215.253.210:24787] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acRSKmj3l1y81GYfluQV9AAAAEk"]
[Thu Mar 26 05:22:58.300368 2026] [:error] [pid 60829:tid 60838] [client 20.215.253.210:41938] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acRSMvTdjHKeZokybaS4bwAAAQc"]
[Thu Mar 26 05:23:01.798148 2026] [:error] [pid 60829:tid 60832] [client 20.215.253.210:42004] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acRSNfTdjHKeZokybaS4hQAAAQE"]
[Thu Mar 26 05:23:05.144957 2026] [:error] [pid 19818:tid 19842] [client 20.215.253.210:41998] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acRSOczaSnm3d1BeM5U8-QAAANY"]
[Thu Mar 26 05:23:06.391535 2026] [:error] [pid 19818:tid 19822] [client 20.215.253.210:42035] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acRSOszaSnm3d1BeM5U8-wAAAMI"]
[Thu Mar 26 05:23:07.351601 2026] [:error] [pid 19818:tid 19843] [client 20.215.253.210:41949] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acRSO8zaSnm3d1BeM5U8_QAAANc"]
[Thu Mar 26 05:23:08.024777 2026] [:error] [pid 19711:tid 19752] [client 20.215.253.210:41996] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-good.php"] [unique_id "acRSPGj3l1y81GYfluQWCAAAAEM"]
[Thu Mar 26 05:23:08.906957 2026] [:error] [pid 19712:tid 19800] [client 20.215.253.210:24830] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-good.php"] [unique_id "acRSPNWhKhRNqm23vFOksgAAAJg"]
[Thu Mar 26 05:23:10.381047 2026] [:error] [pid 19818:tid 19842] [client 20.215.253.210:24782] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-good.php"] [unique_id "acRSPszaSnm3d1BeM5U9BQAAANY"]
[Thu Mar 26 05:23:11.190034 2026] [:error] [pid 19818:tid 19839] [client 20.215.253.210:42000] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-good.php"] [unique_id "acRSP8zaSnm3d1BeM5U9CwAAANM"]
[Thu Mar 26 05:23:12.285533 2026] [:error] [pid 19818:tid 19823] [client 20.215.253.210:24813] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acRSQMzaSnm3d1BeM5U9EgAAAMM"]
[Thu Mar 26 05:23:13.180983 2026] [:error] [pid 19710:tid 19727] [client 20.215.253.210:42019] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acRSQQVEWP8Ar68Njk6EUwAAAAU"]
[Thu Mar 26 05:23:14.359968 2026] [:error] [pid 19818:tid 19835] [client 20.215.253.210:42043] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acRSQszaSnm3d1BeM5U9GQAAAM8"]
[Thu Mar 26 05:23:15.078879 2026] [:error] [pid 19818:tid 19823] [client 20.215.253.210:24811] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acRSQ8zaSnm3d1BeM5U9HQAAAMM"]
[Thu Mar 26 05:23:16.105013 2026] [:error] [pid 19711:tid 19750] [client 20.215.253.210:41994] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acRSRGj3l1y81GYfluQWDgAAAEE"]
[Thu Mar 26 05:23:16.913093 2026] [:error] [pid 19712:tid 19782] [client 20.215.253.210:24805] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acRSRNWhKhRNqm23vFOkwgAAAIY"]
[Thu Mar 26 05:23:17.426511 2026] [:error] [pid 19712:tid 19779] [client 20.215.253.210:24827] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acRSRdWhKhRNqm23vFOkxgAAAIM"]
[Thu Mar 26 05:23:18.174865 2026] [:error] [pid 19818:tid 19843] [client 20.215.253.210:42034] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "acRSRszaSnm3d1BeM5U9JQAAANc"]
[Thu Mar 26 05:23:19.190716 2026] [:error] [pid 60829:tid 60853] [client 20.215.253.210:41942] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acRSR_TdjHKeZokybaS4uwAAARY"]
[Thu Mar 26 05:23:20.073752 2026] [:error] [pid 19712:tid 19781] [client 20.215.253.210:23041] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acRSSNWhKhRNqm23vFOkzQAAAIU"]
[Thu Mar 26 05:23:20.781959 2026] [:error] [pid 19712:tid 19789] [client 20.215.253.210:24774] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acRSSNWhKhRNqm23vFOk0AAAAI0"]
[Thu Mar 26 05:23:21.357812 2026] [:error] [pid 19712:tid 19786] [client 20.215.253.210:24775] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acRSSdWhKhRNqm23vFOk0wAAAIo"]
[Thu Mar 26 05:23:38.874379 2026] [:error] [pid 19712:tid 19799] [client 20.215.253.210:24820] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass.php"] [unique_id "acRSWtWhKhRNqm23vFOlEwAAAJc"]
[Thu Mar 26 05:23:39.939698 2026] [:error] [pid 19818:tid 19833] [client 20.215.253.210:41924] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass.php"] [unique_id "acRSW8zaSnm3d1BeM5U9aQAAAM0"]
[Thu Mar 26 05:23:41.171861 2026] [:error] [pid 19712:tid 19778] [client 20.215.253.210:23055] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass.php"] [unique_id "acRSXdWhKhRNqm23vFOlGAAAAII"]
[Thu Mar 26 05:23:41.958943 2026] [:error] [pid 19818:tid 19835] [client 20.215.253.210:42041] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gifclass.php"] [unique_id "acRSXczaSnm3d1BeM5U9cAAAAM8"]
[Thu Mar 26 05:23:42.523371 2026] [:error] [pid 60829:tid 60852] [client 20.215.253.210:23055] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acRSXvTdjHKeZokybaS47QAAARU"]
[Thu Mar 26 05:23:43.089309 2026] [:error] [pid 19818:tid 19822] [client 20.215.253.210:24772] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acRSX8zaSnm3d1BeM5U9dQAAAMI"]
[Thu Mar 26 05:23:43.634700 2026] [:error] [pid 60829:tid 60847] [client 20.215.253.210:24783] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acRSX_TdjHKeZokybaS48wAAARA"]
[Thu Mar 26 05:23:44.212593 2026] [:error] [pid 60829:tid 60844] [client 20.215.253.210:24815] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bjfl.php"] [unique_id "acRSYPTdjHKeZokybaS49gAAAQ0"]
[Thu Mar 26 05:23:44.763484 2026] [:error] [pid 19712:tid 19791] [client 20.215.253.210:41982] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acRSYNWhKhRNqm23vFOlHwAAAI8"]
[Thu Mar 26 05:23:45.317499 2026] [:error] [pid 19711:tid 19757] [client 20.215.253.210:42018] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acRSYWj3l1y81GYfluQWLQAAAEg"]
[Thu Mar 26 05:23:45.948054 2026] [:error] [pid 19712:tid 19782] [client 20.215.253.210:24784] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acRSYdWhKhRNqm23vFOlIwAAAIY"]
[Thu Mar 26 05:23:47.639421 2026] [:error] [pid 60829:tid 60845] [client 20.215.253.210:24795] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acRSY_TdjHKeZokybaS5AAAAAQ4"]
[Thu Mar 26 05:23:49.431306 2026] [:error] [pid 60829:tid 60855] [client 20.215.253.210:42017] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acRSZfTdjHKeZokybaS5CwAAARg"]
[Thu Mar 26 05:23:50.299903 2026] [:error] [pid 19710:tid 19736] [client 20.215.253.210:24790] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acRSZgVEWP8Ar68Njk6EgAAAAA4"]
[Thu Mar 26 05:23:51.542557 2026] [:error] [pid 19712:tid 19782] [client 20.215.253.210:24824] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acRSZ9WhKhRNqm23vFOlMgAAAIY"]
[Thu Mar 26 05:23:52.733157 2026] [:error] [pid 19712:tid 19789] [client 20.215.253.210:42031] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "acRSaNWhKhRNqm23vFOlOgAAAI0"]
[Thu Mar 26 05:23:54.079392 2026] [:error] [pid 60829:tid 60852] [client 20.215.253.210:24810] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acRSavTdjHKeZokybaS5GQAAARU"]
[Thu Mar 26 05:23:55.480221 2026] [:error] [pid 19711:tid 19754] [client 20.215.253.210:42029] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acRSa2j3l1y81GYfluQWPQAAAEU"]
[Thu Mar 26 05:23:56.546585 2026] [:error] [pid 19712:tid 19796] [client 20.215.253.210:41978] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acRSbNWhKhRNqm23vFOlRwAAAJQ"]
[Thu Mar 26 05:23:57.292995 2026] [:error] [pid 19711:tid 19767] [client 20.215.253.210:24825] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acRSbWj3l1y81GYfluQWPwAAAFI"]
[Thu Mar 26 05:23:58.110853 2026] [:error] [pid 60829:tid 60831] [client 20.215.253.210:24786] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acRSbvTdjHKeZokybaS5KwAAAQA"]
[Thu Mar 26 05:23:58.652124 2026] [:error] [pid 60829:tid 60844] [client 20.215.253.210:23084] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acRSbvTdjHKeZokybaS5MAAAAQ0"]
[Thu Mar 26 05:23:59.315372 2026] [:error] [pid 19818:tid 19841] [client 20.215.253.210:42002] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acRSb8zaSnm3d1BeM5U9kwAAANU"]
[Thu Mar 26 05:23:59.938869 2026] [:error] [pid 19818:tid 19835] [client 20.215.253.210:42010] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acRSb8zaSnm3d1BeM5U9lAAAAM8"]
[Thu Mar 26 05:24:00.513286 2026] [:error] [pid 19712:tid 19777] [client 20.215.253.210:24794] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acRScNWhKhRNqm23vFOlTAAAAIE"]
[Thu Mar 26 05:24:01.199043 2026] [:error] [pid 60829:tid 60854] [client 20.215.253.210:42003] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acRScfTdjHKeZokybaS5NgAAARc"]
[Thu Mar 26 05:24:01.907058 2026] [:error] [pid 19818:tid 19840] [client 20.215.253.210:41987] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acRScczaSnm3d1BeM5U9lgAAANQ"]
[Thu Mar 26 05:24:02.478934 2026] [:error] [pid 19711:tid 19753] [client 20.215.253.210:24808] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acRScmj3l1y81GYfluQWRwAAAEQ"]
[Thu Mar 26 05:24:03.183578 2026] [:error] [pid 60829:tid 60843] [client 20.215.253.210:24801] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "acRSc_TdjHKeZokybaS5QAAAAQw"]
[Thu Mar 26 05:24:03.725124 2026] [:error] [pid 19818:tid 19834] [client 20.215.253.210:41999] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "acRSc8zaSnm3d1BeM5U9oAAAAM4"]
[Thu Mar 26 05:24:04.272615 2026] [:error] [pid 19711:tid 19751] [client 20.215.253.210:41948] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "acRSdGj3l1y81GYfluQWTAAAAEI"]
[Thu Mar 26 05:24:04.961146 2026] [:error] [pid 60829:tid 60845] [client 20.215.253.210:24796] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "acRSdPTdjHKeZokybaS5QwAAAQ4"]
[Thu Mar 26 05:24:05.573576 2026] [:error] [pid 19712:tid 19789] [client 20.215.253.210:24802] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-access.php"] [unique_id "acRSddWhKhRNqm23vFOlVAAAAI0"]
[Thu Mar 26 05:24:06.125753 2026] [:error] [pid 19710:tid 19736] [client 20.215.253.210:41960] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-access.php"] [unique_id "acRSdgVEWP8Ar68Njk6EiwAAAA4"]
[Thu Mar 26 05:24:06.647738 2026] [:error] [pid 19818:tid 19824] [client 20.215.253.210:24821] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-access.php"] [unique_id "acRSdszaSnm3d1BeM5U9sQAAAMQ"]
[Thu Mar 26 05:24:07.183079 2026] [:error] [pid 19710:tid 19744] [client 20.215.253.210:24800] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-access.php"] [unique_id "acRSdwVEWP8Ar68Njk6EjAAAABY"]
[Thu Mar 26 05:24:08.383773 2026] [:error] [pid 19712:tid 19798] [client 20.215.253.210:42028] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cap.php"] [unique_id "acRSeNWhKhRNqm23vFOlWAAAAJY"]
[Thu Mar 26 05:24:08.928067 2026] [:error] [pid 60829:tid 60836] [client 20.215.253.210:24798] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cap.php"] [unique_id "acRSePTdjHKeZokybaS5VQAAAQU"]
[Thu Mar 26 05:24:09.453924 2026] [:error] [pid 19818:tid 19841] [client 20.215.253.210:42023] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cap.php"] [unique_id "acRSeczaSnm3d1BeM5U9swAAANU"]
[Thu Mar 26 05:24:09.986844 2026] [:error] [pid 19712:tid 19783] [client 20.215.253.210:42022] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/Cap.php"] [unique_id "acRSedWhKhRNqm23vFOlWgAAAIc"]
[Thu Mar 26 05:24:10.509795 2026] [:error] [pid 60829:tid 60843] [client 20.215.253.210:41972] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/public/vx.php"] [unique_id "acRSevTdjHKeZokybaS5XQAAAQw"]
[Thu Mar 26 05:24:11.029058 2026] [:error] [pid 60829:tid 60840] [client 20.215.253.210:24823] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/public/vx.php"] [unique_id "acRSe_TdjHKeZokybaS5YAAAAQk"]
[Thu Mar 26 05:24:11.539721 2026] [:error] [pid 19818:tid 19842] [client 20.215.253.210:41967] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/public/vx.php"] [unique_id "acRSe8zaSnm3d1BeM5U9ugAAANY"]
[Thu Mar 26 05:24:12.104659 2026] [:error] [pid 19818:tid 19822] [client 20.215.253.210:42000] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/public/vx.php"] [unique_id "acRSfMzaSnm3d1BeM5U9vgAAAMI"]
[Thu Mar 26 05:24:12.621435 2026] [:error] [pid 19818:tid 19826] [client 20.215.253.210:41925] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "acRSfMzaSnm3d1BeM5U9wAAAAMY"]
[Thu Mar 26 05:24:13.156333 2026] [:error] [pid 19710:tid 19731] [client 20.215.253.210:24799] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "acRSfQVEWP8Ar68Njk6EjwAAAAk"]
[Thu Mar 26 05:24:13.692359 2026] [:error] [pid 19818:tid 19840] [client 20.215.253.210:42026] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "acRSfczaSnm3d1BeM5U9xAAAANQ"]
[Thu Mar 26 05:24:14.255152 2026] [:error] [pid 19818:tid 19839] [client 20.215.253.210:42024] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "acRSfszaSnm3d1BeM5U9xgAAANM"]
[Thu Mar 26 05:24:14.817121 2026] [:error] [pid 60829:tid 60838] [client 20.215.253.210:24788] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acRSfvTdjHKeZokybaS5YwAAAQc"]
[Thu Mar 26 05:24:15.356281 2026] [:error] [pid 19712:tid 19791] [client 20.215.253.210:42040] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acRSf9WhKhRNqm23vFOlXAAAAI8"]
[Thu Mar 26 05:24:15.959060 2026] [:error] [pid 19818:tid 19842] [client 20.215.253.210:41939] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acRSf8zaSnm3d1BeM5U9ywAAANY"]
[Thu Mar 26 05:24:17.245139 2026] [:error] [pid 19818:tid 19844] [client 20.215.253.210:42020] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acRSgczaSnm3d1BeM5U90AAAANg"]
[Thu Mar 26 05:24:18.417609 2026] [:error] [pid 19711:tid 19753] [client 20.215.253.210:24828] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acRSgmj3l1y81GYfluQWXAAAAEQ"]
[Thu Mar 26 05:24:19.633154 2026] [:error] [pid 19818:tid 19843] [client 20.215.253.210:41951] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acRSg8zaSnm3d1BeM5U92gAAANc"]
[Thu Mar 26 05:24:20.224803 2026] [:error] [pid 19710:tid 19741] [client 20.215.253.210:23052] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acRShAVEWP8Ar68Njk6ElgAAABM"]
[Thu Mar 26 05:24:20.781892 2026] [:error] [pid 19710:tid 19742] [client 20.215.253.210:41961] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acRShAVEWP8Ar68Njk6EmgAAABQ"]
[Thu Mar 26 05:24:21.344608 2026] [:error] [pid 19710:tid 19743] [client 20.215.253.210:42037] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acRShQVEWP8Ar68Njk6EnAAAABU"]
[Thu Mar 26 05:24:21.854686 2026] [:error] [pid 60829:tid 60850] [client 20.215.253.210:42033] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acRShfTdjHKeZokybaS5cQAAARM"]
[Thu Mar 26 05:24:22.466130 2026] [:error] [pid 60829:tid 60849] [client 20.215.253.210:24818] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acRShvTdjHKeZokybaS5dAAAARI"]
[Thu Mar 26 05:24:23.026668 2026] [:error] [pid 19710:tid 19726] [client 20.215.253.210:24779] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/d12.php"] [unique_id "acRShwVEWP8Ar68Njk6EoQAAAAQ"]
[Thu Mar 26 05:24:23.719751 2026] [:error] [pid 19710:tid 19746] [client 20.215.253.210:41983] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acRShwVEWP8Ar68Njk6EpQAAABg"]
[Thu Mar 26 05:24:24.258646 2026] [:error] [pid 19710:tid 19736] [client 20.215.253.210:41977] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acRSiAVEWP8Ar68Njk6EpgAAAA4"]
[Thu Mar 26 05:24:24.977504 2026] [:error] [pid 60829:tid 60837] [client 20.215.253.210:23042] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acRSiPTdjHKeZokybaS5gQAAAQY"]
[Thu Mar 26 05:24:25.562013 2026] [:error] [pid 60829:tid 60846] [client 20.215.253.210:42032] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tfm.php"] [unique_id "acRSifTdjHKeZokybaS5hQAAAQ8"]
[Thu Mar 26 05:24:26.088532 2026] [:error] [pid 19818:tid 19823] [client 20.215.253.210:24831] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "acRSiszaSnm3d1BeM5U94QAAAMM"]
[Thu Mar 26 05:24:26.733630 2026] [:error] [pid 60829:tid 60854] [client 20.215.253.210:23057] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "acRSivTdjHKeZokybaS5jAAAARc"]
[Thu Mar 26 05:24:27.338726 2026] [:error] [pid 60829:tid 60853] [client 20.215.253.210:41984] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "acRSi_TdjHKeZokybaS5kAAAARY"]
[Thu Mar 26 05:24:28.044090 2026] [:error] [pid 60829:tid 60836] [client 20.215.253.210:41963] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "acRSjPTdjHKeZokybaS5lQAAAQU"]
[Thu Mar 26 05:24:28.747320 2026] [:error] [pid 60829:tid 60854] [client 20.215.253.210:41926] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acRSjPTdjHKeZokybaS5mQAAARc"]
[Thu Mar 26 05:24:29.316062 2026] [:error] [pid 19818:tid 19837] [client 20.215.253.210:23081] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acRSjczaSnm3d1BeM5U96QAAANE"]
[Thu Mar 26 05:24:30.139684 2026] [:error] [pid 19711:tid 19756] [client 20.215.253.210:24826] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acRSjmj3l1y81GYfluQWXgAAAEc"]
[Thu Mar 26 05:24:30.953302 2026] [:error] [pid 60829:tid 60849] [client 20.215.253.210:24773] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "acRSjvTdjHKeZokybaS5ogAAARI"]
[Thu Mar 26 05:24:31.538121 2026] [:error] [pid 60829:tid 60847] [client 20.215.253.210:41965] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acRSj_TdjHKeZokybaS5qAAAARA"]
[Thu Mar 26 05:24:32.210563 2026] [:error] [pid 60829:tid 60855] [client 20.215.253.210:41921] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acRSkPTdjHKeZokybaS5qgAAARg"]
[Thu Mar 26 05:24:32.737801 2026] [:error] [pid 19818:tid 19824] [client 20.215.253.210:42007] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acRSkMzaSnm3d1BeM5U97wAAAMQ"]
[Thu Mar 26 05:24:33.271719 2026] [:error] [pid 60829:tid 60833] [client 20.215.253.210:30896] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws86.php"] [unique_id "acRSkfTdjHKeZokybaS5vQAAAQI"]
[Thu Mar 26 05:24:33.861382 2026] [:error] [pid 19710:tid 19742] [client 20.215.253.210:30852] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acRSkQVEWP8Ar68Njk6ErAAAABQ"]
[Thu Mar 26 05:24:34.393880 2026] [:error] [pid 19711:tid 19758] [client 20.215.253.210:42047] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acRSkmj3l1y81GYfluQWYQAAAEk"]
[Thu Mar 26 05:24:34.918658 2026] [:error] [pid 60829:tid 60852] [client 20.215.253.210:24780] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acRSkvTdjHKeZokybaS5yAAAARU"]
[Thu Mar 26 05:24:35.586947 2026] [:error] [pid 19711:tid 19759] [client 20.215.253.210:42025] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "acRSk2j3l1y81GYfluQWYwAAAEo"]
[Thu Mar 26 05:24:36.629471 2026] [:error] [pid 60829:tid 60838] [client 20.215.253.210:41922] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin-footer.php"] [unique_id "acRSlPTdjHKeZokybaS50QAAAQc"]
[Thu Mar 26 05:24:55.444736 2026] [:error] [pid 19818:tid 19835] [client 20.215.253.210:23053] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/44.php"] [unique_id "acRSp8zaSnm3d1BeM5U-OwAAAM8"]
[Thu Mar 26 05:24:55.984615 2026] [:error] [pid 19818:tid 19833] [client 20.215.253.210:24771] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/44.php"] [unique_id "acRSp8zaSnm3d1BeM5U-PQAAAM0"]
[Thu Mar 26 05:24:56.496021 2026] [:error] [pid 19818:tid 19843] [client 20.215.253.210:41954] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/44.php"] [unique_id "acRSqMzaSnm3d1BeM5U-PwAAANc"]
[Thu Mar 26 05:24:57.040701 2026] [:error] [pid 60829:tid 60848] [client 20.215.253.210:23066] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/44.php"] [unique_id "acRSqfTdjHKeZokybaS6HwAAARE"]
[Thu Mar 26 05:24:57.553839 2026] [:error] [pid 19711:tid 19767] [client 20.215.253.210:41997] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amp.php"] [unique_id "acRSqWj3l1y81GYfluQWewAAAFI"]
[Thu Mar 26 05:24:58.105454 2026] [:error] [pid 19710:tid 19731] [client 20.215.253.210:42045] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amp.php"] [unique_id "acRSqgVEWP8Ar68Njk6EyAAAAAk"]
[Thu Mar 26 05:24:58.705939 2026] [:error] [pid 19710:tid 19740] [client 20.215.253.210:41941] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws81.php"] [unique_id "acRSqgVEWP8Ar68Njk6EygAAABI"]
[Thu Mar 26 05:24:59.301477 2026] [:error] [pid 60829:tid 60852] [client 20.215.253.210:42012] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws81.php"] [unique_id "acRSq_TdjHKeZokybaS6LQAAARU"]
[Thu Mar 26 05:25:00.309586 2026] [:error] [pid 60829:tid 60836] [client 20.215.253.210:24793] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws81.php"] [unique_id "acRSrPTdjHKeZokybaS6MwAAAQU"]
[Thu Mar 26 05:25:01.201018 2026] [:error] [pid 19818:tid 19833] [client 20.215.253.210:41966] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws81.php"] [unique_id "acRSrczaSnm3d1BeM5U-SgAAAM0"]
[Thu Mar 26 05:25:01.880371 2026] [:error] [pid 60829:tid 60850] [client 20.215.253.210:41956] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acRSrfTdjHKeZokybaS6dwAAARM"]
[Thu Mar 26 05:25:02.559867 2026] [:error] [pid 19710:tid 19741] [client 20.215.253.210:24814] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acRSrgVEWP8Ar68Njk6E4gAAABM"]
[Thu Mar 26 05:25:03.224013 2026] [:error] [pid 60829:tid 60852] [client 20.215.253.210:41934] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acRSr_TdjHKeZokybaS6fgAAARU"]
[Thu Mar 26 05:25:04.022014 2026] [:error] [pid 19711:tid 19764] [client 20.215.253.210:41929] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sid3.php"] [unique_id "acRSsGj3l1y81GYfluQWggAAAE8"]
[Thu Mar 26 05:25:04.640404 2026] [:error] [pid 19710:tid 19731] [client 20.215.253.210:30875] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx78.php"] [unique_id "acRSsAVEWP8Ar68Njk6E6gAAAAk"]
[Thu Mar 26 05:25:05.336950 2026] [:error] [pid 60829:tid 60834] [client 20.215.253.210:41952] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tx78.php"] [unique_id "acRSsfTdjHKeZokybaS6nAAAAQM"]
[Thu Mar 26 05:25:07.283659 2026] [:error] [pid 19818:tid 19835] [client 20.215.253.210:42036] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "acRSs8zaSnm3d1BeM5U-TQAAAM8"]
[Thu Mar 26 05:25:10.718556 2026] [:error] [pid 19711:tid 19763] [client 20.215.253.210:42027] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "acRStmj3l1y81GYfluQWlQAAAE4"]
[Thu Mar 26 05:25:12.970787 2026] [:error] [pid 19818:tid 19821] [client 20.215.253.210:23061] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "acRSuMzaSnm3d1BeM5U-WwAAAME"]
[Thu Mar 26 05:25:14.450486 2026] [:error] [pid 60829:tid 60834] [client 20.215.253.210:41935] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "acRSuvTdjHKeZokybaS6twAAAQM"]
[Thu Mar 26 05:25:16.410948 2026] [:error] [pid 19710:tid 19738] [client 20.215.253.210:24817] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acRSvAVEWP8Ar68Njk6FIAAAABA"]
[Thu Mar 26 05:25:17.152780 2026] [:error] [pid 19818:tid 19831] [client 20.215.253.210:41940] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acRSvczaSnm3d1BeM5U-aAAAAMs"]
[Thu Mar 26 05:25:17.808922 2026] [:error] [pid 19818:tid 19820] [client 20.215.253.210:30908] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acRSvczaSnm3d1BeM5U-bAAAAMA"]
[Thu Mar 26 05:25:18.414758 2026] [:error] [pid 60829:tid 60851] [client 20.215.253.210:41927] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/asd.php"] [unique_id "acRSvvTdjHKeZokybaS6ywAAARQ"]
[Thu Mar 26 05:25:19.014647 2026] [:error] [pid 60829:tid 60850] [client 20.215.253.210:42013] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acRSv_TdjHKeZokybaS6zwAAARM"]
[Thu Mar 26 05:25:19.527187 2026] [:error] [pid 19712:tid 19793] [client 20.215.253.210:23074] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acRSv9WhKhRNqm23vFOlzgAAAJE"]
[Thu Mar 26 05:25:20.039486 2026] [:error] [pid 19710:tid 19736] [client 20.215.253.210:23046] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acRSwAVEWP8Ar68Njk6FKwAAAA4"]
[Thu Mar 26 05:25:20.672471 2026] [:error] [pid 19712:tid 19781] [client 20.215.253.210:30849] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/byypas.php"] [unique_id "acRSwNWhKhRNqm23vFOl0gAAAIU"]
[Thu Mar 26 05:25:21.182682 2026] [:error] [pid 19712:tid 19790] [client 20.215.253.210:41947] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/myfile.php"] [unique_id "acRSwdWhKhRNqm23vFOl0wAAAI4"]
[Thu Mar 26 05:25:21.733398 2026] [:error] [pid 60829:tid 60842] [client 20.215.253.210:30886] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/myfile.php"] [unique_id "acRSwfTdjHKeZokybaS60wAAAQs"]
[Thu Mar 26 05:25:22.274907 2026] [:error] [pid 60829:tid 60836] [client 20.215.253.210:24804] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/myfile.php"] [unique_id "acRSwvTdjHKeZokybaS61QAAAQU"]
[Thu Mar 26 05:25:22.825545 2026] [:error] [pid 19712:tid 19800] [client 20.215.253.210:41990] [client 20.215.253.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/myfile.php"] [unique_id "acRSwtWhKhRNqm23vFOl2gAAAJg"]
[Thu Mar 26 06:09:55.966827 2026] [:error] [pid 60829:tid 60836] [client 70.64.96.129:65384] [client 70.64.96.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.64.96.129, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acRdM_TdjHKeZokybaThygAAAQU"]
[Thu Mar 26 06:11:46.915061 2026] [:error] [pid 60829:tid 60848] [client 177.124.34.67:15986] [client 177.124.34.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.124.34.67, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acRdovTdjHKeZokybaTjNwAAARE"]
[Thu Mar 26 07:12:51.671513 2026] [:error] [pid 19818:tid 19840] [client 192.3.207.218:56457] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/artisan"] [unique_id "acRr88zaSnm3d1BeM5WNQQAAANQ"]
[Thu Mar 26 07:12:52.097489 2026] [:error] [pid 19712:tid 19778] [client 192.3.207.218:56914] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/artisan"] [unique_id "acRr9NWhKhRNqm23vFPd9wAAAII"]
[Thu Mar 26 07:12:53.199469 2026] [:error] [pid 60829:tid 60839] [client 192.3.207.218:57312] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com"] [uri "/artisan"] [unique_id "acRr9fTdjHKeZokybaQpjgAAAQg"]
[Thu Mar 26 07:12:53.632445 2026] [:error] [pid 60829:tid 60837] [client 192.3.207.218:57855] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com"] [uri "/artisan"] [unique_id "acRr9fTdjHKeZokybaQpoAAAAQY"]
[Thu Mar 26 07:12:54.490248 2026] [:error] [pid 19711:tid 19755] [client 192.3.207.218:58189] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "acRr9mj3l1y81GYfluRJlgAAAEY"]
[Thu Mar 26 07:12:54.914591 2026] [:error] [pid 19710:tid 19726] [client 192.3.207.218:58875] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "acRr9gVEWP8Ar68Njk6pPgAAAAQ"]
[Thu Mar 26 07:12:55.878139 2026] [:error] [pid 31780:tid 31826] [client 192.3.207.218:59275] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "acRr95JDwZsy5O4ZXEiUWwAAAgY"]
[Thu Mar 26 07:12:56.301063 2026] [:error] [pid 31670:tid 31673] [client 192.3.207.218:60335] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "acRr-DXVthXxCnWjOTQx9wAAAUE"]
[Thu Mar 26 07:41:46.098225 2026] [:error] [pid 60829:tid 60836] [client 101.42.46.71:46454] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acRyuvTdjHKeZokybaQxswAAAQU"]
[Thu Mar 26 10:37:06.233339 2026] [:error] [pid 31670:tid 31681] [client 43.156.228.27:34638] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acSb0jXVthXxCnWjOTScXQAAAUk"]
[Thu Mar 26 14:13:53.382341 2026] [:error] [pid 31717:tid 31736] [client 106.51.148.10:12981] [client 106.51.148.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.148.10, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acTOob-SCF7YDISDX4-1oAAAAY4"]
[Thu Mar 26 15:08:22.863327 2026] [:error] [pid 31670:tid 31672] [client 49.233.45.47:53236] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acTbZjXVthXxCnWjOTQb5AAAAUA"]
[Thu Mar 26 15:44:46.685247 2026] [:error] [pid 31670:tid 31694] [client 43.157.175.122:44822] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acTj7jXVthXxCnWjOTQrngAAAVY"]
[Thu Mar 26 18:14:40.133820 2026] [:error] [pid 60829:tid 60841] [client 49.51.39.209:51182] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acUHEPTdjHKeZokybaS0QwAAAQo"]
[Thu Mar 26 20:34:27.349325 2026] [:error] [pid 31717:tid 31743] [client 45.116.113.98:61370] [client 45.116.113.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.116.113.98, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acUn07-SCF7YDISDX4_xZwAAAZU"]
[Thu Mar 26 20:34:27.909775 2026] [:error] [pid 19818:tid 19839] [client 103.126.229.87:61337] [client 103.126.229.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.126.229.87, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acUn08zaSnm3d1BeM5UlFwAAANM"]
[Thu Mar 26 20:42:44.403783 2026] [:error] [pid 31670:tid 31681] [client 101.32.15.141:50226] [client 101.32.15.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acUpxDXVthXxCnWjOTS_ggAAAUk"]
[Thu Mar 26 22:49:43.883416 2026] [:error] [pid 31780:tid 31839] [client 182.44.10.67:47117] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acVHh5JDwZsy5O4ZXEjQ_gAAAhI"]
[Fri Mar 27 01:38:05.602101 2026] [:error] [pid 62149:tid 62530] [client 185.169.4.152:53623] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "acVu_WHvvta9MPqU8PVlZQAAAQY"]
[Fri Mar 27 01:38:06.277741 2026] [:error] [pid 62147:tid 62480] [client 185.169.4.152:53622] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.vscode/sftp.json"] [unique_id "acVu_hPjxn06mcLazN6ACgAAABQ"]
[Fri Mar 27 04:26:18.093352 2026] [:error] [pid 27851:tid 27873] [client 43.153.119.119:59284] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acWWanR2ccxe3RMCLbrwhQAAAM8"]
[Fri Mar 27 05:51:21.981924 2026] [:error] [pid 63897:tid 63917] [client 182.42.111.156:46868] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acWqWWVSkmYmLu7ycYjtfAAAARI"]
[Fri Mar 27 07:11:42.512789 2026] [:error] [pid 27851:tid 27862] [client 43.153.96.79:40256] [client 43.153.96.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acW9LnR2ccxe3RMCLbokXwAAAMQ"]
[Fri Mar 27 07:16:43.316048 2026] [ssl:error] [pid 4341:tid 4353] [client 47.128.112.48:31930] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: http://paramountestate.com/robots.txt
[Fri Mar 27 11:15:22.906515 2026] [:error] [pid 27851:tid 27880] [client 103.199.205.68:14326] [client 103.199.205.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.199.205.68, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acX2SnR2ccxe3RMCLbpopAAAANY"]
[Fri Mar 27 11:15:52.304704 2026] [:error] [pid 27851:tid 27870] [client 61.1.116.149:54249] [client 61.1.116.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.1.116.149, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acX2aHR2ccxe3RMCLbpoyQAAAMw"]
[Fri Mar 27 12:41:50.046811 2026] [:error] [pid 63897:tid 63902] [client 182.42.105.144:60151] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acYKjmVSkmYmLu7ycYi8bQAAAQM"]
[Fri Mar 27 18:17:28.163305 2026] [:error] [pid 4341:tid 4351] [client 20.91.231.89:13579] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sace.php"] [unique_id "acZZOOKJWrNB5dMlERF43AAAAYg"]
[Fri Mar 27 18:17:29.257304 2026] [:error] [pid 27743:tid 27785] [client 20.91.231.89:21199] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sace.php"] [unique_id "acZZOSA46UYYLqzw99Ct8AAAABU"]
[Fri Mar 27 18:17:30.926133 2026] [:error] [pid 27743:tid 27780] [client 20.91.231.89:8582] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sace.php"] [unique_id "acZZOiA46UYYLqzw99Ct9gAAABA"]
[Fri Mar 27 18:17:32.013523 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:8277] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sace.php"] [unique_id "acZZPJLjeJUC3OKtEx83iQAAAVI"]
[Fri Mar 27 18:17:33.108175 2026] [:error] [pid 27749:tid 27806] [client 20.91.231.89:4124] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/north1.php"] [unique_id "acZZPcEqyoMni2Q6_X7gzQAAAE8"]
[Fri Mar 27 18:17:34.042659 2026] [:error] [pid 27750:tid 27831] [client 20.91.231.89:51086] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/north1.php"] [unique_id "acZZPoaSil5rd17ieLzb6AAAAI0"]
[Fri Mar 27 18:17:34.850307 2026] [:error] [pid 63897:tid 63903] [client 20.91.231.89:51113] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/north1.php"] [unique_id "acZZPmVSkmYmLu7ycYgvvQAAAQQ"]
[Fri Mar 27 18:17:35.740287 2026] [:error] [pid 63897:tid 63923] [client 20.91.231.89:21207] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/north1.php"] [unique_id "acZZP2VSkmYmLu7ycYgvwwAAARg"]
[Fri Mar 27 18:17:36.548652 2026] [:error] [pid 27750:tid 27819] [client 20.91.231.89:14524] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fine.php"] [unique_id "acZZQIaSil5rd17ieLzb7QAAAIE"]
[Fri Mar 27 18:17:37.803048 2026] [:error] [pid 4341:tid 4352] [client 20.91.231.89:15307] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fine.php"] [unique_id "acZZQeKJWrNB5dMlERF48AAAAYk"]
[Fri Mar 27 18:17:38.794267 2026] [:error] [pid 63897:tid 63911] [client 20.91.231.89:22764] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fine.php"] [unique_id "acZZQmVSkmYmLu7ycYgvxgAAAQw"]
[Fri Mar 27 18:17:40.503533 2026] [:error] [pid 27749:tid 27804] [client 20.91.231.89:16079] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fine.php"] [unique_id "acZZRMEqyoMni2Q6_X7g0wAAAE0"]
[Fri Mar 27 18:17:41.263361 2026] [:error] [pid 4293:tid 4296] [client 20.91.231.89:4096] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zample.php"] [unique_id "acZZRZLjeJUC3OKtEx83mQAAAUE"]
[Fri Mar 27 18:17:43.136924 2026] [:error] [pid 63897:tid 63917] [client 20.91.231.89:20688] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zample.php"] [unique_id "acZZR2VSkmYmLu7ycYgv0QAAARI"]
[Fri Mar 27 18:17:43.785489 2026] [:error] [pid 63897:tid 63908] [client 20.91.231.89:23235] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zample.php"] [unique_id "acZZR2VSkmYmLu7ycYgv0gAAAQk"]
[Fri Mar 27 18:17:44.590777 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:37995] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zample.php"] [unique_id "acZZSJLjeJUC3OKtEx83rAAAAUQ"]
[Fri Mar 27 18:17:45.647669 2026] [:error] [pid 4341:tid 4357] [client 20.91.231.89:31960] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/read.php"] [unique_id "acZZSeKJWrNB5dMlERF4-gAAAY4"]
[Fri Mar 27 18:17:46.454417 2026] [:error] [pid 63897:tid 63923] [client 20.91.231.89:11833] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/read.php"] [unique_id "acZZSmVSkmYmLu7ycYgv2QAAARg"]
[Fri Mar 27 18:17:48.970549 2026] [:error] [pid 4341:tid 4364] [client 20.91.231.89:33927] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/read.php"] [unique_id "acZZTOKJWrNB5dMlERF5BQAAAZU"]
[Fri Mar 27 18:17:49.613843 2026] [:error] [pid 27743:tid 27778] [client 20.91.231.89:36686] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/read.php"] [unique_id "acZZTSA46UYYLqzw99CuGwAAAA4"]
[Fri Mar 27 18:17:50.764445 2026] [:error] [pid 27743:tid 27768] [client 20.91.231.89:31897] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZZTiA46UYYLqzw99CuIgAAAAQ"]
[Fri Mar 27 18:17:51.831926 2026] [:error] [pid 27743:tid 27774] [client 20.91.231.89:32550] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZZTyA46UYYLqzw99CuKQAAAAo"]
[Fri Mar 27 18:17:52.908629 2026] [:error] [pid 4293:tid 4310] [client 20.91.231.89:14522] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZZUJLjeJUC3OKtEx83vgAAAU8"]
[Fri Mar 27 18:17:54.387189 2026] [:error] [pid 27749:tid 27810] [client 20.91.231.89:9503] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZZUsEqyoMni2Q6_X7g4gAAAFM"]
[Fri Mar 27 18:17:55.065802 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:36703] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acZZUyA46UYYLqzw99CuOwAAAAc"]
[Fri Mar 27 18:17:55.831889 2026] [:error] [pid 27750:tid 27830] [client 20.91.231.89:32549] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acZZU4aSil5rd17ieLzcIAAAAIw"]
[Fri Mar 27 18:17:56.534570 2026] [:error] [pid 63897:tid 63901] [client 20.91.231.89:9524] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acZZVGVSkmYmLu7ycYgv4gAAAQI"]
[Fri Mar 27 18:17:57.367840 2026] [:error] [pid 27743:tid 27783] [client 20.91.231.89:34673] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hplfuns.php"] [unique_id "acZZVSA46UYYLqzw99CuQwAAABM"]
[Fri Mar 27 18:17:58.115871 2026] [:error] [pid 27851:tid 27866] [client 20.91.231.89:9529] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xa.php"] [unique_id "acZZVnR2ccxe3RMCLbrWWgAAAMg"]
[Fri Mar 27 18:17:58.810988 2026] [:error] [pid 4293:tid 4312] [client 20.91.231.89:23274] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xa.php"] [unique_id "acZZVpLjeJUC3OKtEx830QAAAVE"]
[Fri Mar 27 18:17:59.743871 2026] [:error] [pid 63897:tid 63920] [client 20.91.231.89:37960] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xa.php"] [unique_id "acZZV2VSkmYmLu7ycYgv6AAAARU"]
[Fri Mar 27 18:18:00.336815 2026] [:error] [pid 4341:tid 4354] [client 20.91.231.89:12113] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xa.php"] [unique_id "acZZWOKJWrNB5dMlERF5JAAAAYs"]
[Fri Mar 27 18:18:01.176269 2026] [:error] [pid 27743:tid 27778] [client 20.91.231.89:15029] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "acZZWSA46UYYLqzw99CuTwAAAA4"]
[Fri Mar 27 18:18:01.981492 2026] [:error] [pid 4293:tid 4311] [client 20.91.231.89:14996] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "acZZWZLjeJUC3OKtEx837wAAAVA"]
[Fri Mar 27 18:18:02.722526 2026] [:error] [pid 27743:tid 27775] [client 20.91.231.89:15775] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "acZZWiA46UYYLqzw99CuWQAAAAs"]
[Fri Mar 27 18:18:03.505805 2026] [:error] [pid 63897:tid 63900] [client 20.91.231.89:14765] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "acZZW2VSkmYmLu7ycYgv6gAAAQE"]
[Fri Mar 27 18:18:04.369083 2026] [:error] [pid 63897:tid 63903] [client 20.91.231.89:24848] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless13.php"] [unique_id "acZZXGVSkmYmLu7ycYgv8AAAAQQ"]
[Fri Mar 27 18:18:05.040887 2026] [:error] [pid 4293:tid 4309] [client 20.91.231.89:11319] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless13.php"] [unique_id "acZZXZLjeJUC3OKtEx839wAAAU4"]
[Fri Mar 27 18:18:05.722507 2026] [:error] [pid 27750:tid 27820] [client 20.91.231.89:11547] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless13.php"] [unique_id "acZZXYaSil5rd17ieLzcLQAAAII"]
[Fri Mar 27 18:18:06.391507 2026] [:error] [pid 4341:tid 4354] [client 20.91.231.89:13431] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless13.php"] [unique_id "acZZXuKJWrNB5dMlERF5KgAAAYs"]
[Fri Mar 27 18:18:06.976087 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:25596] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mter.php"] [unique_id "acZZXpLjeJUC3OKtEx83_wAAAUQ"]
[Fri Mar 27 18:18:07.900724 2026] [:error] [pid 63897:tid 63908] [client 20.91.231.89:11293] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mter.php"] [unique_id "acZZX2VSkmYmLu7ycYgv9gAAAQk"]
[Fri Mar 27 18:18:08.700549 2026] [:error] [pid 27743:tid 27783] [client 20.91.231.89:15757] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mter.php"] [unique_id "acZZYCA46UYYLqzw99CuagAAABM"]
[Fri Mar 27 18:18:09.362381 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:7529] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-mter.php"] [unique_id "acZZYSA46UYYLqzw99CubwAAAAc"]
[Fri Mar 27 18:18:10.133338 2026] [:error] [pid 27851:tid 27863] [client 20.91.231.89:25548] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acZZYnR2ccxe3RMCLbrWZgAAAMU"]
[Fri Mar 27 18:18:10.874451 2026] [:error] [pid 4293:tid 4297] [client 20.91.231.89:14723] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acZZYpLjeJUC3OKtEx84DwAAAUI"]
[Fri Mar 27 18:18:11.650001 2026] [:error] [pid 63897:tid 63903] [client 20.91.231.89:25559] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acZZY2VSkmYmLu7ycYgv_gAAAQQ"]
[Fri Mar 27 18:18:12.495108 2026] [:error] [pid 27743:tid 27776] [client 20.91.231.89:16810] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inege.php"] [unique_id "acZZZCA46UYYLqzw99CufgAAAAw"]
[Fri Mar 27 18:18:13.261631 2026] [:error] [pid 27743:tid 27764] [client 20.91.231.89:26339] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "acZZZSA46UYYLqzw99CuhgAAAAA"]
[Fri Mar 27 18:18:14.264314 2026] [:error] [pid 63897:tid 63905] [client 20.91.231.89:15514] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "acZZZmVSkmYmLu7ycYgwCgAAAQY"]
[Fri Mar 27 18:18:15.239568 2026] [:error] [pid 4293:tid 4310] [client 20.91.231.89:26306] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "acZZZ5LjeJUC3OKtEx84GwAAAU8"]
[Fri Mar 27 18:18:15.850988 2026] [:error] [pid 4293:tid 4300] [client 20.91.231.89:15499] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "acZZZ5LjeJUC3OKtEx84JwAAAUU"]
[Fri Mar 27 18:18:16.639205 2026] [:error] [pid 27743:tid 27786] [client 20.91.231.89:29569] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fe5.php"] [unique_id "acZZaCA46UYYLqzw99CumwAAABY"]
[Fri Mar 27 18:18:17.380643 2026] [:error] [pid 27743:tid 27778] [client 20.91.231.89:13417] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fe5.php"] [unique_id "acZZaSA46UYYLqzw99CupQAAAA4"]
[Fri Mar 27 18:18:18.137299 2026] [:error] [pid 4341:tid 4352] [client 20.91.231.89:4886] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fe5.php"] [unique_id "acZZauKJWrNB5dMlERF5RQAAAYk"]
[Fri Mar 27 18:18:18.712691 2026] [:error] [pid 27851:tid 27869] [client 20.91.231.89:37927] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fe5.php"] [unique_id "acZZanR2ccxe3RMCLbrWdgAAAMs"]
[Fri Mar 27 18:18:19.275237 2026] [:error] [pid 27750:tid 27832] [client 20.91.231.89:37941] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file61.php"] [unique_id "acZZa4aSil5rd17ieLzcPQAAAI4"]
[Fri Mar 27 18:18:20.071384 2026] [:error] [pid 4341:tid 4362] [client 20.91.231.89:4871] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file61.php"] [unique_id "acZZbOKJWrNB5dMlERF5TwAAAZM"]
[Fri Mar 27 18:18:20.696691 2026] [:error] [pid 63897:tid 63923] [client 20.91.231.89:26355] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file61.php"] [unique_id "acZZbGVSkmYmLu7ycYgwEAAAARg"]
[Fri Mar 27 18:18:21.414545 2026] [:error] [pid 27743:tid 27770] [client 20.91.231.89:26308] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file61.php"] [unique_id "acZZbSA46UYYLqzw99CuxAAAAAY"]
[Fri Mar 27 18:18:22.274267 2026] [:error] [pid 27851:tid 27876] [client 20.91.231.89:4884] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acZZbnR2ccxe3RMCLbrWfAAAANI"]
[Fri Mar 27 18:18:23.114311 2026] [:error] [pid 63897:tid 63906] [client 20.91.231.89:15502] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acZZb2VSkmYmLu7ycYgwFAAAAQc"]
[Fri Mar 27 18:18:24.495878 2026] [:error] [pid 63897:tid 63907] [client 20.91.231.89:26354] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/uuu.php"] [unique_id "acZZcGVSkmYmLu7ycYgwGgAAAQg"]
[Fri Mar 27 18:18:48.598211 2026] [:error] [pid 63897:tid 63916] [client 20.91.231.89:23801] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acZZiGVSkmYmLu7ycYgwgAAAARE"]
[Fri Mar 27 18:18:49.533299 2026] [:error] [pid 4293:tid 4303] [client 20.91.231.89:24921] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acZZiZLjeJUC3OKtEx84awAAAUg"]
[Fri Mar 27 18:18:51.506612 2026] [:error] [pid 27743:tid 27768] [client 20.91.231.89:14727] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acZZiyA46UYYLqzw99CvAgAAAAQ"]
[Fri Mar 27 18:18:52.781028 2026] [:error] [pid 4293:tid 4309] [client 20.91.231.89:12358] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/edit.php"] [unique_id "acZZjJLjeJUC3OKtEx84gwAAAU4"]
[Fri Mar 27 18:18:53.846278 2026] [:error] [pid 27851:tid 27858] [client 20.91.231.89:14753] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acZZjXR2ccxe3RMCLbrWrwAAAMA"]
[Fri Mar 27 18:18:55.776656 2026] [:error] [pid 27743:tid 27773] [client 20.91.231.89:7860] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acZZjyA46UYYLqzw99CvDgAAAAk"]
[Fri Mar 27 18:18:57.184210 2026] [:error] [pid 27851:tid 27876] [client 20.91.231.89:25552] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acZZkXR2ccxe3RMCLbrWtAAAANI"]
[Fri Mar 27 18:18:58.873088 2026] [:error] [pid 4293:tid 4296] [client 20.91.231.89:4588] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "acZZkpLjeJUC3OKtEx84lQAAAUE"]
[Fri Mar 27 18:19:00.022087 2026] [:error] [pid 27750:tid 27839] [client 20.91.231.89:24917] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZlIaSil5rd17ieLzcaAAAAJU"]
[Fri Mar 27 18:19:01.250501 2026] [:error] [pid 63897:tid 63912] [client 20.91.231.89:43048] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZlWVSkmYmLu7ycYgwjgAAAQ0"]
[Fri Mar 27 18:19:02.229094 2026] [:error] [pid 27743:tid 27767] [client 20.91.231.89:43045] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZliA46UYYLqzw99CvIQAAAAM"]
[Fri Mar 27 18:19:03.052632 2026] [:error] [pid 4341:tid 4357] [client 20.91.231.89:22164] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZl-KJWrNB5dMlERF5uwAAAY4"]
[Fri Mar 27 18:19:03.817105 2026] [:error] [pid 4293:tid 4316] [client 20.91.231.89:4214] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "acZZl5LjeJUC3OKtEx84pwAAAVU"]
[Fri Mar 27 18:19:04.760405 2026] [:error] [pid 27743:tid 27782] [client 20.91.231.89:12415] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "acZZmCA46UYYLqzw99CvJgAAABI"]
[Fri Mar 27 18:19:06.007727 2026] [:error] [pid 27750:tid 27826] [client 20.91.231.89:33189] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "acZZmoaSil5rd17ieLzcbQAAAIg"]
[Fri Mar 27 18:19:07.284592 2026] [:error] [pid 27851:tid 27874] [client 20.91.231.89:12373] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "acZZm3R2ccxe3RMCLbrWvwAAANA"]
[Fri Mar 27 18:19:08.279753 2026] [:error] [pid 63897:tid 63923] [client 20.91.231.89:22152] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acZZnGVSkmYmLu7ycYgwmQAAARg"]
[Fri Mar 27 18:19:09.476479 2026] [:error] [pid 63897:tid 63915] [client 20.91.231.89:43024] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acZZnWVSkmYmLu7ycYgwnAAAARA"]
[Fri Mar 27 18:19:10.364276 2026] [:error] [pid 63897:tid 63907] [client 20.91.231.89:27643] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acZZnmVSkmYmLu7ycYgwoAAAAQg"]
[Fri Mar 27 18:19:11.362468 2026] [:error] [pid 27743:tid 27778] [client 20.91.231.89:7883] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "acZZnyA46UYYLqzw99CvNwAAAA4"]
[Fri Mar 27 18:19:12.249399 2026] [:error] [pid 27749:tid 27805] [client 20.91.231.89:33164] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acZZoMEqyoMni2Q6_X7hDQAAAE4"]
[Fri Mar 27 18:19:13.456960 2026] [:error] [pid 27743:tid 27767] [client 20.91.231.89:8033] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acZZoSA46UYYLqzw99CvQQAAAAM"]
[Fri Mar 27 18:19:14.114891 2026] [:error] [pid 4293:tid 4302] [client 20.91.231.89:12849] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acZZopLjeJUC3OKtEx84sQAAAUc"]
[Fri Mar 27 18:19:14.941588 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:7886] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acZZopLjeJUC3OKtEx84uAAAAUQ"]
[Fri Mar 27 18:19:15.778529 2026] [:error] [pid 4293:tid 4295] [client 20.91.231.89:22150] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acZZo5LjeJUC3OKtEx84wAAAAUA"]
[Fri Mar 27 18:19:16.599287 2026] [:error] [pid 4341:tid 4362] [client 20.91.231.89:9756] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acZZpOKJWrNB5dMlERF56AAAAZM"]
[Fri Mar 27 18:19:17.408444 2026] [:error] [pid 27851:tid 27878] [client 20.91.231.89:7879] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acZZpXR2ccxe3RMCLbrW1AAAANQ"]
[Fri Mar 27 18:19:18.340574 2026] [:error] [pid 4293:tid 4314] [client 20.91.231.89:24910] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "acZZppLjeJUC3OKtEx84xQAAAVM"]
[Fri Mar 27 18:19:19.326160 2026] [:error] [pid 27743:tid 27777] [client 20.91.231.89:18679] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "acZZpyA46UYYLqzw99CvTAAAAA0"]
[Fri Mar 27 18:19:20.266488 2026] [:error] [pid 4293:tid 4315] [client 20.91.231.89:36034] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "acZZqJLjeJUC3OKtEx840wAAAVQ"]
[Fri Mar 27 18:19:21.448913 2026] [:error] [pid 27743:tid 27788] [client 20.91.231.89:4308] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "acZZqSA46UYYLqzw99CvUQAAABg"]
[Fri Mar 27 18:19:23.241353 2026] [:error] [pid 27750:tid 27820] [client 20.91.231.89:11644] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "acZZq4aSil5rd17ieLzclAAAAII"]
[Fri Mar 27 18:19:24.417070 2026] [:error] [pid 4293:tid 4308] [client 20.91.231.89:4325] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "acZZrJLjeJUC3OKtEx843gAAAU0"]
[Fri Mar 27 18:19:27.614305 2026] [:error] [pid 27743:tid 27783] [client 20.91.231.89:22203] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "acZZryA46UYYLqzw99CvbAAAABM"]
[Fri Mar 27 18:19:28.653114 2026] [:error] [pid 27750:tid 27822] [client 20.91.231.89:48152] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "acZZsIaSil5rd17ieLzcnAAAAIQ"]
[Fri Mar 27 18:19:29.632325 2026] [:error] [pid 4293:tid 4295] [client 20.91.231.89:11602] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "acZZsZLjeJUC3OKtEx847QAAAUA"]
[Fri Mar 27 18:19:30.616278 2026] [:error] [pid 27749:tid 27813] [client 20.91.231.89:10064] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "acZZssEqyoMni2Q6_X7hHAAAAFY"]
[Fri Mar 27 18:19:31.354914 2026] [:error] [pid 4293:tid 4305] [client 20.91.231.89:14028] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "acZZs5LjeJUC3OKtEx84-gAAAUo"]
[Fri Mar 27 18:19:32.043005 2026] [:error] [pid 27851:tid 27859] [client 20.91.231.89:30803] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "acZZtHR2ccxe3RMCLbrW2wAAAME"]
[Fri Mar 27 18:19:33.003343 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:10307] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "acZZtZLjeJUC3OKtEx85AwAAAVI"]
[Fri Mar 27 18:19:33.798454 2026] [:error] [pid 27750:tid 27841] [client 20.91.231.89:30837] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acZZtYaSil5rd17ieLzcpAAAAJc"]
[Fri Mar 27 18:19:34.476952 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:14057] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acZZtpLjeJUC3OKtEx85CAAAAUQ"]
[Fri Mar 27 18:19:35.255729 2026] [:error] [pid 4293:tid 4315] [client 20.91.231.89:18651] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acZZt5LjeJUC3OKtEx85DQAAAVQ"]
[Fri Mar 27 18:19:36.362333 2026] [:error] [pid 27749:tid 27804] [client 20.91.231.89:10093] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "acZZuMEqyoMni2Q6_X7hIAAAAE0"]
[Fri Mar 27 18:19:37.786584 2026] [:error] [pid 27851:tid 27871] [client 20.91.231.89:18674] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "acZZuXR2ccxe3RMCLbrW3gAAAM0"]
[Fri Mar 27 18:19:39.560838 2026] [:error] [pid 27743:tid 27775] [client 20.91.231.89:30805] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "acZZuyA46UYYLqzw99CvjAAAAAs"]
[Fri Mar 27 18:19:40.676017 2026] [:error] [pid 27750:tid 27823] [client 20.91.231.89:38590] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "acZZvIaSil5rd17ieLzcpwAAAIU"]
[Fri Mar 27 18:19:41.643824 2026] [:error] [pid 63897:tid 63920] [client 20.91.231.89:10341] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aa.php"] [unique_id "acZZvWVSkmYmLu7ycYgwzQAAARU"]
[Fri Mar 27 18:19:42.309606 2026] [:error] [pid 27851:tid 27861] [client 20.91.231.89:26894] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acZZvnR2ccxe3RMCLbrW4gAAAMM"]
[Fri Mar 27 18:19:43.043583 2026] [:error] [pid 4341:tid 4356] [client 20.91.231.89:32597] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acZZv-KJWrNB5dMlERF6BQAAAY0"]
[Fri Mar 27 18:19:43.936338 2026] [:error] [pid 27750:tid 27831] [client 20.91.231.89:16352] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acZZv4aSil5rd17ieLzcqwAAAI0"]
[Fri Mar 27 18:19:44.558888 2026] [:error] [pid 27749:tid 27808] [client 20.91.231.89:48164] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "acZZwMEqyoMni2Q6_X7hJgAAAFE"]
[Fri Mar 27 18:19:45.298523 2026] [:error] [pid 4293:tid 4298] [client 20.91.231.89:10360] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "acZZwZLjeJUC3OKtEx85MwAAAUM"]
[Fri Mar 27 18:19:46.063671 2026] [:error] [pid 27749:tid 27792] [client 20.91.231.89:8203] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "acZZwsEqyoMni2Q6_X7hKAAAAEE"]
[Fri Mar 27 18:19:46.918783 2026] [:error] [pid 27749:tid 27796] [client 20.91.231.89:16057] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "acZZwsEqyoMni2Q6_X7hKgAAAEU"]
[Fri Mar 27 18:20:12.454901 2026] [:error] [pid 4341:tid 4364] [client 20.91.231.89:7970] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sbhu.php"] [unique_id "acZZ3OKJWrNB5dMlERF6YAAAAZU"]
[Fri Mar 27 18:20:13.097227 2026] [:error] [pid 4293:tid 4311] [client 20.91.231.89:43123] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sbhu.php"] [unique_id "acZZ3ZLjeJUC3OKtEx85nwAAAVA"]
[Fri Mar 27 18:20:13.803761 2026] [:error] [pid 4293:tid 4305] [client 20.91.231.89:12333] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sbhu.php"] [unique_id "acZZ3ZLjeJUC3OKtEx85pAAAAUo"]
[Fri Mar 27 18:20:14.369984 2026] [:error] [pid 27750:tid 27828] [client 20.91.231.89:41154] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sbhu.php"] [unique_id "acZZ3oaSil5rd17ieLzcywAAAIo"]
[Fri Mar 27 18:20:15.641947 2026] [:error] [pid 4293:tid 4309] [client 20.91.231.89:7370] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acZZ35LjeJUC3OKtEx85rwAAAU4"]
[Fri Mar 27 18:20:16.244396 2026] [:error] [pid 27750:tid 27839] [client 20.91.231.89:46752] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acZZ4IaSil5rd17ieLzczQAAAJU"]
[Fri Mar 27 18:20:16.921105 2026] [:error] [pid 4293:tid 4298] [client 20.91.231.89:35226] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acZZ4JLjeJUC3OKtEx85uQAAAUM"]
[Fri Mar 27 18:20:17.761033 2026] [:error] [pid 4293:tid 4314] [client 20.91.231.89:16637] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog.php"] [unique_id "acZZ4ZLjeJUC3OKtEx85xAAAAVM"]
[Fri Mar 27 18:20:18.470251 2026] [:error] [pid 27851:tid 27873] [client 20.91.231.89:22218] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acZZ4nR2ccxe3RMCLbrW-QAAAM8"]
[Fri Mar 27 18:20:19.488031 2026] [:error] [pid 63897:tid 63911] [client 20.91.231.89:8830] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acZZ42VSkmYmLu7ycYgw6gAAAQw"]
[Fri Mar 27 18:20:20.039919 2026] [:error] [pid 27851:tid 27864] [client 20.91.231.89:8801] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acZZ5HR2ccxe3RMCLbrXAQAAAMY"]
[Fri Mar 27 18:20:20.579972 2026] [:error] [pid 4341:tid 4363] [client 20.91.231.89:8816] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "acZZ5OKJWrNB5dMlERF6ZwAAAZQ"]
[Fri Mar 27 18:20:21.420076 2026] [:error] [pid 63897:tid 63908] [client 20.91.231.89:4532] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acZZ5WVSkmYmLu7ycYgw8QAAAQk"]
[Fri Mar 27 18:20:22.099751 2026] [:error] [pid 63897:tid 63922] [client 20.91.231.89:10860] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acZZ5mVSkmYmLu7ycYgw9AAAARc"]
[Fri Mar 27 18:20:22.823876 2026] [:error] [pid 4293:tid 4304] [client 20.91.231.89:13161] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acZZ5pLjeJUC3OKtEx851wAAAUk"]
[Fri Mar 27 18:20:23.421710 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:46824] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acZZ55LjeJUC3OKtEx853QAAAVI"]
[Fri Mar 27 18:20:24.195059 2026] [:error] [pid 4293:tid 4309] [client 20.91.231.89:40063] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acZZ6JLjeJUC3OKtEx854gAAAU4"]
[Fri Mar 27 18:20:24.945835 2026] [:error] [pid 4293:tid 4319] [client 20.91.231.89:35258] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acZZ6JLjeJUC3OKtEx855wAAAVg"]
[Fri Mar 27 18:20:25.520519 2026] [:error] [pid 4293:tid 4296] [client 20.91.231.89:43132] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acZZ6ZLjeJUC3OKtEx857wAAAUE"]
[Fri Mar 27 18:20:26.258649 2026] [:error] [pid 27743:tid 27781] [client 20.91.231.89:8785] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "acZZ6iA46UYYLqzw99Cv0AAAABE"]
[Fri Mar 27 18:20:26.865672 2026] [:error] [pid 4341:tid 4349] [client 20.91.231.89:10854] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZ6uKJWrNB5dMlERF6awAAAYY"]
[Fri Mar 27 18:20:27.470984 2026] [:error] [pid 27743:tid 27774] [client 20.91.231.89:45396] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZ6yA46UYYLqzw99Cv1wAAAAo"]
[Fri Mar 27 18:20:28.377524 2026] [:error] [pid 4293:tid 4315] [client 20.91.231.89:5039] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZ7JLjeJUC3OKtEx85_AAAAVQ"]
[Fri Mar 27 18:20:29.043038 2026] [:error] [pid 4341:tid 4356] [client 20.91.231.89:28955] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "acZZ7eKJWrNB5dMlERF6cAAAAY0"]
[Fri Mar 27 18:20:29.704532 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:60090] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ7SA46UYYLqzw99Cv3AAAAAc"]
[Fri Mar 27 18:20:30.457839 2026] [:error] [pid 4341:tid 4355] [client 20.91.231.89:34620] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ7uKJWrNB5dMlERF6dwAAAYw"]
[Fri Mar 27 18:20:31.232767 2026] [:error] [pid 27750:tid 27839] [client 20.91.231.89:45418] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ74aSil5rd17ieLzc1wAAAJU"]
[Fri Mar 27 18:20:31.815121 2026] [:error] [pid 4293:tid 4302] [client 20.91.231.89:5047] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ75LjeJUC3OKtEx86BwAAAUc"]
[Fri Mar 27 18:20:32.436965 2026] [:error] [pid 27851:tid 27871] [client 20.91.231.89:8794] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "acZZ8HR2ccxe3RMCLbrXEQAAAM0"]
[Fri Mar 27 18:20:33.131707 2026] [:error] [pid 4341:tid 4344] [client 20.91.231.89:10829] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "acZZ8eKJWrNB5dMlERF6fAAAAYE"]
[Fri Mar 27 18:20:33.810711 2026] [:error] [pid 63897:tid 63904] [client 20.91.231.89:34580] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "acZZ8WVSkmYmLu7ycYgw_wAAAQU"]
[Fri Mar 27 18:20:34.379880 2026] [:error] [pid 4341:tid 4355] [client 20.91.231.89:40048] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "acZZ8uKJWrNB5dMlERF6hQAAAYw"]
[Fri Mar 27 18:20:34.974430 2026] [:error] [pid 27851:tid 27873] [client 20.91.231.89:8769] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acZZ8nR2ccxe3RMCLbrXEwAAAM8"]
[Fri Mar 27 18:20:35.568155 2026] [:error] [pid 27743:tid 27782] [client 20.91.231.89:28939] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acZZ8yA46UYYLqzw99Cv4gAAABI"]
[Fri Mar 27 18:20:36.118739 2026] [:error] [pid 27743:tid 27775] [client 20.91.231.89:10825] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acZZ9CA46UYYLqzw99Cv5AAAAAs"]
[Fri Mar 27 18:20:36.811593 2026] [:error] [pid 63897:tid 63903] [client 20.91.231.89:41729] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "acZZ9GVSkmYmLu7ycYgxAQAAAQQ"]
[Fri Mar 27 18:20:37.355846 2026] [:error] [pid 4341:tid 4354] [client 20.91.231.89:34593] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ9eKJWrNB5dMlERF6lwAAAYs"]
[Fri Mar 27 18:20:38.188919 2026] [:error] [pid 4341:tid 4359] [client 20.91.231.89:45435] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ9uKJWrNB5dMlERF6mAAAAZA"]
[Fri Mar 27 18:20:38.716426 2026] [:error] [pid 27750:tid 27837] [client 20.91.231.89:51190] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ9oaSil5rd17ieLzc5AAAAJM"]
[Fri Mar 27 18:20:41.476042 2026] [:error] [pid 4341:tid 4347] [client 20.91.231.89:5000] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "acZZ-eKJWrNB5dMlERF6mgAAAYQ"]
[Fri Mar 27 18:20:42.021863 2026] [:error] [pid 27743:tid 27780] [client 20.91.231.89:16639] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acZZ-iA46UYYLqzw99Cv9wAAABA"]
[Fri Mar 27 18:20:42.547353 2026] [:error] [pid 4341:tid 4354] [client 20.91.231.89:28991] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acZZ-uKJWrNB5dMlERF6nwAAAYs"]
[Fri Mar 27 18:20:43.082456 2026] [:error] [pid 27851:tid 27866] [client 20.91.231.89:16607] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acZZ-3R2ccxe3RMCLbrXHQAAAMg"]
[Fri Mar 27 18:20:43.625595 2026] [:error] [pid 27851:tid 27869] [client 20.91.231.89:34581] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "acZZ-3R2ccxe3RMCLbrXHgAAAMs"]
[Fri Mar 27 18:20:44.151007 2026] [:error] [pid 27851:tid 27862] [client 20.91.231.89:51184] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "acZZ_HR2ccxe3RMCLbrXIAAAAMQ"]
[Fri Mar 27 18:20:44.705201 2026] [:error] [pid 63897:tid 63907] [client 20.91.231.89:40012] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "acZZ_GVSkmYmLu7ycYgxHAAAAQg"]
[Fri Mar 27 18:20:45.291023 2026] [:error] [pid 4341:tid 4355] [client 20.91.231.89:7943] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "acZZ_eKJWrNB5dMlERF6owAAAYw"]
[Fri Mar 27 18:20:45.858725 2026] [:error] [pid 4341:tid 4360] [client 20.91.231.89:34619] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "acZZ_eKJWrNB5dMlERF6pAAAAZE"]
[Fri Mar 27 18:20:46.396288 2026] [:error] [pid 27743:tid 27775] [client 20.91.231.89:14589] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff1.php"] [unique_id "acZZ_iA46UYYLqzw99CwBwAAAAs"]
[Fri Mar 27 18:20:46.992682 2026] [:error] [pid 27749:tid 27813] [client 20.91.231.89:60065] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff1.php"] [unique_id "acZZ_sEqyoMni2Q6_X7hZwAAAFY"]
[Fri Mar 27 18:20:47.568489 2026] [:error] [pid 4341:tid 4356] [client 20.91.231.89:34609] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff1.php"] [unique_id "acZZ_-KJWrNB5dMlERF6rQAAAY0"]
[Fri Mar 27 18:20:48.173723 2026] [:error] [pid 27851:tid 27877] [client 20.91.231.89:4622] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ff1.php"] [unique_id "acZaAHR2ccxe3RMCLbrXKAAAANM"]
[Fri Mar 27 18:20:48.728660 2026] [:error] [pid 4341:tid 4352] [client 20.91.231.89:21139] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acZaAOKJWrNB5dMlERF6rwAAAYk"]
[Fri Mar 27 18:20:49.256609 2026] [:error] [pid 27851:tid 27861] [client 20.91.231.89:14540] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acZaAXR2ccxe3RMCLbrXKwAAAMM"]
[Fri Mar 27 18:20:49.839649 2026] [:error] [pid 27743:tid 27767] [client 20.91.231.89:8780] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acZaASA46UYYLqzw99CwDwAAAAM"]
[Fri Mar 27 18:20:50.374992 2026] [:error] [pid 63897:tid 63922] [client 20.91.231.89:10861] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "acZaAmVSkmYmLu7ycYgxIwAAARc"]
[Fri Mar 27 18:20:50.903544 2026] [:error] [pid 27743:tid 27781] [client 20.91.231.89:60091] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "acZaAiA46UYYLqzw99CwGAAAABE"]
[Fri Mar 27 18:20:51.493827 2026] [:error] [pid 27750:tid 27823] [client 20.91.231.89:28948] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "acZaA4aSil5rd17ieLzc8AAAAIU"]
[Fri Mar 27 18:20:52.048632 2026] [:error] [pid 27750:tid 27827] [client 20.91.231.89:28946] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "acZaBIaSil5rd17ieLzc9QAAAIk"]
[Fri Mar 27 18:20:52.698610 2026] [:error] [pid 63897:tid 63920] [client 20.91.231.89:5014] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "acZaBGVSkmYmLu7ycYgxKAAAARU"]
[Fri Mar 27 18:20:53.451742 2026] [:error] [pid 27743:tid 27767] [client 20.91.231.89:4657] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acZaBSA46UYYLqzw99CwHAAAAAM"]
[Fri Mar 27 18:20:54.408459 2026] [:error] [pid 4293:tid 4302] [client 20.91.231.89:45977] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acZaBpLjeJUC3OKtEx86JwAAAUc"]
[Fri Mar 27 18:20:55.077948 2026] [:error] [pid 27743:tid 27769] [client 20.91.231.89:12670] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acZaByA46UYYLqzw99CwIwAAAAU"]
[Fri Mar 27 18:20:56.017821 2026] [:error] [pid 27750:tid 27837] [client 20.91.231.89:11135] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/155.php"] [unique_id "acZaCIaSil5rd17ieLzc-QAAAJM"]
[Fri Mar 27 18:20:57.007832 2026] [:error] [pid 27743:tid 27768] [client 20.91.231.89:11102] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acZaCSA46UYYLqzw99CwNAAAAAQ"]
[Fri Mar 27 18:20:57.895113 2026] [:error] [pid 4293:tid 4298] [client 20.91.231.89:10859] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acZaCZLjeJUC3OKtEx86KwAAAUM"]
[Fri Mar 27 18:20:58.829003 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:18177] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acZaCpLjeJUC3OKtEx86NwAAAVI"]
[Fri Mar 27 18:20:59.522363 2026] [:error] [pid 63897:tid 63912] [client 20.91.231.89:12640] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/we.php"] [unique_id "acZaC2VSkmYmLu7ycYgxLAAAAQ0"]
[Fri Mar 27 18:21:00.331374 2026] [:error] [pid 4341:tid 4357] [client 20.91.231.89:28946] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "acZaDOKJWrNB5dMlERF6uQAAAY4"]
[Fri Mar 27 18:21:01.297160 2026] [:error] [pid 27743:tid 27775] [client 20.91.231.89:11102] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "acZaDSA46UYYLqzw99CwQwAAAAs"]
[Fri Mar 27 18:21:02.243966 2026] [:error] [pid 27750:tid 27841] [client 20.91.231.89:12327] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "acZaDoaSil5rd17ieLzc_QAAAJc"]
[Fri Mar 27 18:21:03.324842 2026] [:error] [pid 63897:tid 63902] [client 20.91.231.89:51159] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "acZaD2VSkmYmLu7ycYgxLgAAAQM"]
[Fri Mar 27 18:21:04.143703 2026] [:error] [pid 27749:tid 27804] [client 20.91.231.89:21125] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "acZaEMEqyoMni2Q6_X7hfAAAAE0"]
[Fri Mar 27 18:21:05.020420 2026] [:error] [pid 27749:tid 27792] [client 20.91.231.89:51138] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "acZaEcEqyoMni2Q6_X7hgAAAAEE"]
[Fri Mar 27 18:21:05.798767 2026] [:error] [pid 27749:tid 27793] [client 20.91.231.89:21129] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "acZaEcEqyoMni2Q6_X7hgwAAAEI"]
[Fri Mar 27 18:21:06.618340 2026] [:error] [pid 63897:tid 63910] [client 20.91.231.89:51188] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "acZaEmVSkmYmLu7ycYgxNQAAAQs"]
[Fri Mar 27 18:21:07.270717 2026] [:error] [pid 4341:tid 4346] [client 20.91.231.89:12647] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-michan.php"] [unique_id "acZaE-KJWrNB5dMlERF6wwAAAYM"]
[Fri Mar 27 18:21:08.075416 2026] [:error] [pid 27743:tid 27764] [client 20.91.231.89:36008] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-michan.php"] [unique_id "acZaFCA46UYYLqzw99CwTgAAAAA"]
[Fri Mar 27 18:21:08.729122 2026] [:error] [pid 4293:tid 4305] [client 20.91.231.89:16863] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-michan.php"] [unique_id "acZaFJLjeJUC3OKtEx86SwAAAUo"]
[Fri Mar 27 18:21:09.378829 2026] [:error] [pid 63897:tid 63905] [client 20.91.231.89:8540] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-michan.php"] [unique_id "acZaFWVSkmYmLu7ycYgxOQAAAQY"]
[Fri Mar 27 18:21:10.069884 2026] [:error] [pid 4293:tid 4312] [client 20.91.231.89:8548] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-the.php"] [unique_id "acZaFpLjeJUC3OKtEx86VwAAAVE"]
[Fri Mar 27 18:21:30.223172 2026] [:error] [pid 4341:tid 4348] [client 20.91.231.89:17166] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fi.php"] [unique_id "acZaKuKJWrNB5dMlERF7CAAAAYU"]
[Fri Mar 27 18:21:31.260634 2026] [:error] [pid 63897:tid 63919] [client 20.91.231.89:13095] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fi.php"] [unique_id "acZaK2VSkmYmLu7ycYgxRgAAARQ"]
[Fri Mar 27 18:21:31.862498 2026] [:error] [pid 4341:tid 4353] [client 20.91.231.89:17889] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fi.php"] [unique_id "acZaK-KJWrNB5dMlERF7FQAAAYo"]
[Fri Mar 27 18:21:32.559213 2026] [:error] [pid 63897:tid 63915] [client 20.91.231.89:11132] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fi.php"] [unique_id "acZaLGVSkmYmLu7ycYgxSgAAARA"]
[Fri Mar 27 18:21:33.376536 2026] [:error] [pid 63897:tid 63910] [client 20.91.231.89:17593] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "acZaLWVSkmYmLu7ycYgxTwAAAQs"]
[Fri Mar 27 18:21:34.117705 2026] [:error] [pid 27743:tid 27767] [client 20.91.231.89:7435] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "acZaLiA46UYYLqzw99CwwAAAAAM"]
[Fri Mar 27 18:21:34.829519 2026] [:error] [pid 27750:tid 27827] [client 20.91.231.89:13067] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "acZaLoaSil5rd17ieLzdMAAAAIk"]
[Fri Mar 27 18:21:35.479950 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:30757] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "acZaL5LjeJUC3OKtEx86kwAAAUQ"]
[Fri Mar 27 18:21:36.294032 2026] [:error] [pid 27743:tid 27782] [client 20.91.231.89:7454] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update/f35.php"] [unique_id "acZaMCA46UYYLqzw99CwzgAAABI"]
[Fri Mar 27 18:21:36.932158 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:39953] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update/f35.php"] [unique_id "acZaMCA46UYYLqzw99Cw0wAAAAc"]
[Fri Mar 27 18:21:37.903700 2026] [:error] [pid 27851:tid 27861] [client 20.91.231.89:30766] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update/f35.php"] [unique_id "acZaMXR2ccxe3RMCLbrXagAAAMM"]
[Fri Mar 27 18:21:39.010344 2026] [:error] [pid 63897:tid 63904] [client 20.91.231.89:41829] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update/f35.php"] [unique_id "acZaM2VSkmYmLu7ycYgxWQAAAQU"]
[Fri Mar 27 18:21:39.872124 2026] [:error] [pid 4293:tid 4316] [client 20.91.231.89:41748] [client 20.91.231.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acZaM5LjeJUC3OKtEx86oAAAAVU"]
[Fri Mar 27 18:21:40.888357 2026] [:error] [pid 4293:tid 4319] [client 20.91.231.89:9060] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f35.php"] [unique_id "acZaNJLjeJUC3OKtEx86qQAAAVg"]
[Fri Mar 27 18:21:41.769018 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:34007] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f35.php"] [unique_id "acZaNZLjeJUC3OKtEx86sgAAAUQ"]
[Fri Mar 27 18:21:42.608278 2026] [:error] [pid 4293:tid 4307] [client 20.91.231.89:41814] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f35.php"] [unique_id "acZaNpLjeJUC3OKtEx86vAAAAUw"]
[Fri Mar 27 18:21:43.354888 2026] [:error] [pid 4293:tid 4298] [client 20.91.231.89:39948] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f35.php"] [unique_id "acZaN5LjeJUC3OKtEx86xwAAAUM"]
[Fri Mar 27 18:21:44.451939 2026] [:error] [pid 27851:tid 27859] [client 20.91.231.89:54942] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "acZaOHR2ccxe3RMCLbrXbQAAAME"]
[Fri Mar 27 18:21:45.433902 2026] [:error] [pid 4341:tid 4359] [client 20.91.231.89:39956] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "acZaOeKJWrNB5dMlERF7LAAAAZA"]
[Fri Mar 27 18:21:46.281025 2026] [:error] [pid 27743:tid 27779] [client 20.91.231.89:17583] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "acZaOiA46UYYLqzw99Cw4QAAAA8"]
[Fri Mar 27 18:21:47.042340 2026] [:error] [pid 27750:tid 27837] [client 20.91.231.89:54942] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "acZaO4aSil5rd17ieLzdPwAAAJM"]
[Fri Mar 27 18:21:48.064164 2026] [:error] [pid 4293:tid 4301] [client 20.91.231.89:34028] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/"] [unique_id "acZaPJLjeJUC3OKtEx860gAAAUY"]
[Fri Mar 27 18:21:49.170421 2026] [:error] [pid 4341:tid 4360] [client 20.91.231.89:39938] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/"] [unique_id "acZaPeKJWrNB5dMlERF7MgAAAZE"]
[Fri Mar 27 18:21:49.812494 2026] [:error] [pid 4293:tid 4303] [client 20.91.231.89:7473] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/"] [unique_id "acZaPZLjeJUC3OKtEx860wAAAUg"]
[Fri Mar 27 18:21:50.412432 2026] [:error] [pid 27743:tid 27778] [client 20.91.231.89:31323] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/"] [unique_id "acZaPiA46UYYLqzw99Cw7AAAAA4"]
[Fri Mar 27 18:21:52.222288 2026] [:error] [pid 63897:tid 63917] [client 20.91.231.89:42407] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/prv8.php"] [unique_id "acZaQGVSkmYmLu7ycYgxeQAAARI"]
[Fri Mar 27 18:21:52.876416 2026] [:error] [pid 27750:tid 27842] [client 20.91.231.89:7261] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/prv8.php"] [unique_id "acZaQIaSil5rd17ieLzdTwAAAJg"]
[Fri Mar 27 18:21:53.462961 2026] [:error] [pid 4341:tid 4349] [client 20.91.231.89:7481] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/prv8.php"] [unique_id "acZaQeKJWrNB5dMlERF7OgAAAYY"]
[Fri Mar 27 18:21:54.298871 2026] [:error] [pid 4341:tid 4360] [client 20.91.231.89:7249] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/prv8.php"] [unique_id "acZaQuKJWrNB5dMlERF7OwAAAZE"]
[Fri Mar 27 18:21:54.948102 2026] [:error] [pid 63897:tid 63914] [client 20.91.231.89:42444] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acZaQmVSkmYmLu7ycYgxjAAAAQ8"]
[Fri Mar 27 18:21:55.530242 2026] [:error] [pid 27851:tid 27877] [client 20.91.231.89:54963] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acZaQ3R2ccxe3RMCLbrXfwAAANM"]
[Fri Mar 27 18:21:56.114310 2026] [:error] [pid 63897:tid 63904] [client 20.91.231.89:30764] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acZaRGVSkmYmLu7ycYgxlgAAAQU"]
[Fri Mar 27 18:21:56.858903 2026] [:error] [pid 27743:tid 27769] [client 20.91.231.89:60010] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/k.php"] [unique_id "acZaRCA46UYYLqzw99Cw9QAAAAU"]
[Fri Mar 27 18:21:57.482839 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:9292] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dev.php"] [unique_id "acZaRZLjeJUC3OKtEx863AAAAVI"]
[Fri Mar 27 18:21:58.053122 2026] [:error] [pid 27851:tid 27881] [client 20.91.231.89:7292] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dev.php"] [unique_id "acZaRnR2ccxe3RMCLbrXhwAAANc"]
[Fri Mar 27 18:21:58.667333 2026] [:error] [pid 4341:tid 4343] [client 20.91.231.89:19674] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dev.php"] [unique_id "acZaRuKJWrNB5dMlERF7QQAAAYA"]
[Fri Mar 27 18:21:59.269224 2026] [:error] [pid 27851:tid 27864] [client 20.91.231.89:54972] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dev.php"] [unique_id "acZaR3R2ccxe3RMCLbrXiQAAAMY"]
[Fri Mar 27 18:21:59.811299 2026] [:error] [pid 27750:tid 27826] [client 20.91.231.89:13632] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bal.php"] [unique_id "acZaR4aSil5rd17ieLzdUQAAAIg"]
[Fri Mar 27 18:22:00.380964 2026] [:error] [pid 63897:tid 63901] [client 20.91.231.89:25507] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bal.php"] [unique_id "acZaSGVSkmYmLu7ycYgxmgAAAQI"]
[Fri Mar 27 18:22:01.029451 2026] [:error] [pid 27851:tid 27861] [client 20.91.231.89:9288] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bal.php"] [unique_id "acZaSXR2ccxe3RMCLbrXjgAAAMM"]
[Fri Mar 27 18:22:01.596673 2026] [:error] [pid 27851:tid 27869] [client 20.91.231.89:54928] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bal.php"] [unique_id "acZaSXR2ccxe3RMCLbrXjwAAAMs"]
[Fri Mar 27 18:22:02.159441 2026] [:error] [pid 63897:tid 63902] [client 20.91.231.89:19668] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/in.php"] [unique_id "acZaSmVSkmYmLu7ycYgxnQAAAQM"]
[Fri Mar 27 18:22:02.766888 2026] [:error] [pid 27743:tid 27780] [client 20.91.231.89:17880] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/in.php"] [unique_id "acZaSiA46UYYLqzw99CxCAAAABA"]
[Fri Mar 27 18:22:03.305543 2026] [:error] [pid 27743:tid 27776] [client 20.91.231.89:19702] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/in.php"] [unique_id "acZaSyA46UYYLqzw99CxDQAAAAw"]
[Fri Mar 27 18:22:03.835787 2026] [:error] [pid 4341:tid 4367] [client 20.91.231.89:7588] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/in.php"] [unique_id "acZaS-KJWrNB5dMlERF7UAAAAZg"]
[Fri Mar 27 18:22:04.378918 2026] [:error] [pid 4341:tid 4349] [client 20.91.231.89:9024] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gssdd.php"] [unique_id "acZaTOKJWrNB5dMlERF7VwAAAYY"]
[Fri Mar 27 18:22:04.984324 2026] [:error] [pid 4341:tid 4354] [client 20.91.231.89:9052] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gssdd.php"] [unique_id "acZaTOKJWrNB5dMlERF7XgAAAYs"]
[Fri Mar 27 18:22:05.550841 2026] [:error] [pid 4341:tid 4356] [client 20.91.231.89:42453] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gssdd.php"] [unique_id "acZaTeKJWrNB5dMlERF7ZwAAAY0"]
[Fri Mar 27 18:22:06.096401 2026] [:error] [pid 4341:tid 4349] [client 20.91.231.89:17910] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gssdd.php"] [unique_id "acZaTuKJWrNB5dMlERF7bQAAAYY"]
[Fri Mar 27 18:22:06.659112 2026] [:error] [pid 27743:tid 27770] [client 20.91.231.89:54952] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acZaTiA46UYYLqzw99CxFgAAAAY"]
[Fri Mar 27 18:22:07.188926 2026] [:error] [pid 63897:tid 63900] [client 20.91.231.89:9291] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acZaT2VSkmYmLu7ycYgxowAAAQE"]
[Fri Mar 27 18:22:07.777328 2026] [:error] [pid 4293:tid 4318] [client 20.91.231.89:42461] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acZaT5LjeJUC3OKtEx867gAAAVc"]
[Fri Mar 27 18:22:08.361020 2026] [:error] [pid 27750:tid 27832] [client 20.91.231.89:18274] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/motu.php"] [unique_id "acZaUIaSil5rd17ieLzdWwAAAI4"]
[Fri Mar 27 18:22:08.892006 2026] [:error] [pid 4293:tid 4315] [client 20.91.231.89:25483] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acZaUJLjeJUC3OKtEx869QAAAVQ"]
[Fri Mar 27 18:22:09.444078 2026] [:error] [pid 27743:tid 27778] [client 20.91.231.89:7239] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acZaUSA46UYYLqzw99CxJAAAAA4"]
[Fri Mar 27 18:22:10.093893 2026] [:error] [pid 27749:tid 27811] [client 20.91.231.89:31330] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acZaUsEqyoMni2Q6_X7htgAAAFQ"]
[Fri Mar 27 18:22:10.628390 2026] [:error] [pid 27743:tid 27777] [client 20.91.231.89:26306] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "acZaUiA46UYYLqzw99CxKgAAAA0"]
[Fri Mar 27 18:22:11.171207 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:13662] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bengi.php"] [unique_id "acZaUyA46UYYLqzw99CxMAAAAAc"]
[Fri Mar 27 18:22:11.726670 2026] [:error] [pid 63897:tid 63915] [client 20.91.231.89:13971] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bengi.php"] [unique_id "acZaU2VSkmYmLu7ycYgxrAAAARA"]
[Fri Mar 27 18:22:12.289021 2026] [:error] [pid 4341:tid 4356] [client 20.91.231.89:7597] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bengi.php"] [unique_id "acZaVOKJWrNB5dMlERF7cgAAAY0"]
[Fri Mar 27 18:22:12.827680 2026] [:error] [pid 63897:tid 63905] [client 20.91.231.89:7630] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bengi.php"] [unique_id "acZaVGVSkmYmLu7ycYgxsAAAAQY"]
[Fri Mar 27 18:22:13.417364 2026] [:error] [pid 27749:tid 27794] [client 20.91.231.89:13994] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZaVcEqyoMni2Q6_X7hvQAAAEM"]
[Fri Mar 27 18:22:14.003484 2026] [:error] [pid 63897:tid 63920] [client 20.91.231.89:31303] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZaVmVSkmYmLu7ycYgxsgAAARU"]
[Fri Mar 27 18:22:14.598116 2026] [:error] [pid 63897:tid 63899] [client 20.91.231.89:42401] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZaVmVSkmYmLu7ycYgxtAAAAQA"]
[Fri Mar 27 18:22:15.125470 2026] [:error] [pid 4341:tid 4353] [client 20.91.231.89:19696] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZaV-KJWrNB5dMlERF7dgAAAYo"]
[Fri Mar 27 18:22:15.650899 2026] [:error] [pid 4341:tid 4354] [client 20.91.231.89:33277] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "acZaV-KJWrNB5dMlERF7egAAAYs"]
[Fri Mar 27 18:22:16.218658 2026] [:error] [pid 63897:tid 63923] [client 20.91.231.89:7250] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "acZaWGVSkmYmLu7ycYgxvAAAARg"]
[Fri Mar 27 18:22:16.751860 2026] [:error] [pid 63897:tid 63920] [client 20.91.231.89:27002] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "acZaWGVSkmYmLu7ycYgxwwAAARU"]
[Fri Mar 27 18:22:17.295454 2026] [:error] [pid 27749:tid 27806] [client 20.91.231.89:7260] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "acZaWcEqyoMni2Q6_X7hwwAAAE8"]
[Fri Mar 27 18:22:17.823187 2026] [:error] [pid 27750:tid 27830] [client 20.91.231.89:19643] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfashell.php"] [unique_id "acZaWYaSil5rd17ieLzdZAAAAIw"]
[Fri Mar 27 18:22:18.368833 2026] [:error] [pid 27851:tid 27868] [client 20.91.231.89:30764] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfashell.php"] [unique_id "acZaWnR2ccxe3RMCLbrXqgAAAMo"]
[Fri Mar 27 18:22:18.895540 2026] [:error] [pid 27851:tid 27864] [client 20.91.231.89:46068] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfashell.php"] [unique_id "acZaWnR2ccxe3RMCLbrXrQAAAMY"]
[Fri Mar 27 18:22:19.446979 2026] [:error] [pid 4293:tid 4317] [client 20.91.231.89:7555] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alfashell.php"] [unique_id "acZaW5LjeJUC3OKtEx86_QAAAVY"]
[Fri Mar 27 18:22:20.001166 2026] [:error] [pid 4341:tid 4350] [client 20.91.231.89:25472] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acZaXOKJWrNB5dMlERF7gAAAAYc"]
[Fri Mar 27 18:22:20.540986 2026] [:error] [pid 27750:tid 27827] [client 20.91.231.89:7628] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acZaXIaSil5rd17ieLzdbQAAAIk"]
[Fri Mar 27 18:22:21.068225 2026] [:error] [pid 27851:tid 27868] [client 20.91.231.89:60018] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acZaXXR2ccxe3RMCLbrXtAAAAMo"]
[Fri Mar 27 18:22:21.641778 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:26955] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "acZaXZLjeJUC3OKtEx86_gAAAVI"]
[Fri Mar 27 18:22:22.194307 2026] [:error] [pid 63897:tid 63916] [client 20.91.231.89:7263] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flower.php"] [unique_id "acZaXmVSkmYmLu7ycYgxyQAAARE"]
[Fri Mar 27 18:22:22.734028 2026] [:error] [pid 63897:tid 63903] [client 20.91.231.89:42473] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flower.php"] [unique_id "acZaXmVSkmYmLu7ycYgxywAAAQQ"]
[Fri Mar 27 18:22:23.313484 2026] [:error] [pid 27743:tid 27779] [client 20.91.231.89:46026] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flower.php"] [unique_id "acZaXyA46UYYLqzw99CxOAAAAA8"]
[Fri Mar 27 18:22:23.909862 2026] [:error] [pid 27743:tid 27772] [client 20.91.231.89:7605] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/flower.php"] [unique_id "acZaXyA46UYYLqzw99CxOQAAAAg"]
[Fri Mar 27 18:22:24.468013 2026] [:error] [pid 4293:tid 4300] [client 20.91.231.89:33254] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acZaYJLjeJUC3OKtEx87BwAAAUU"]
[Fri Mar 27 18:22:24.993844 2026] [:error] [pid 4293:tid 4315] [client 20.91.231.89:30250] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acZaYJLjeJUC3OKtEx87CgAAAVQ"]
[Fri Mar 27 18:22:25.584152 2026] [:error] [pid 4341:tid 4347] [client 20.91.231.89:26983] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acZaYeKJWrNB5dMlERF7ggAAAYQ"]
[Fri Mar 27 18:22:26.125983 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:11367] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "acZaYpLjeJUC3OKtEx87FQAAAUQ"]
[Fri Mar 27 18:22:26.667464 2026] [:error] [pid 27851:tid 27874] [client 20.91.231.89:14804] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acZaYnR2ccxe3RMCLbrXvAAAANA"]
[Fri Mar 27 18:22:27.233986 2026] [:error] [pid 4293:tid 4303] [client 20.91.231.89:30269] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acZaY5LjeJUC3OKtEx87GwAAAUg"]
[Fri Mar 27 18:22:27.778711 2026] [:error] [pid 4293:tid 4299] [client 20.91.231.89:8585] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acZaY5LjeJUC3OKtEx87IgAAAUQ"]
[Fri Mar 27 18:22:28.323034 2026] [:error] [pid 4293:tid 4312] [client 20.91.231.89:33224] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "acZaZJLjeJUC3OKtEx87KQAAAVE"]
[Fri Mar 27 18:22:28.900321 2026] [:error] [pid 63897:tid 63922] [client 20.91.231.89:24314] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sdm.php"] [unique_id "acZaZGVSkmYmLu7ycYgx4QAAARc"]
[Fri Mar 27 18:22:46.483438 2026] [:error] [pid 27750:tid 27830] [client 20.91.231.89:15871] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "acZadoaSil5rd17ieLzdqAAAAIw"]
[Fri Mar 27 18:22:47.027017 2026] [:error] [pid 27749:tid 27808] [client 20.91.231.89:8609] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "acZad8EqyoMni2Q6_X7h6wAAAFE"]
[Fri Mar 27 18:22:47.567343 2026] [:error] [pid 27750:tid 27824] [client 20.91.231.89:24295] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "acZad4aSil5rd17ieLzdqgAAAIY"]
[Fri Mar 27 18:22:48.146273 2026] [:error] [pid 27851:tid 27865] [client 20.91.231.89:8390] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file21.php"] [unique_id "acZaeHR2ccxe3RMCLbrX2gAAAMc"]
[Fri Mar 27 18:22:48.685836 2026] [:error] [pid 27749:tid 27798] [client 20.91.231.89:25472] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "acZaeMEqyoMni2Q6_X7h8gAAAEc"]
[Fri Mar 27 18:22:49.237623 2026] [:error] [pid 4293:tid 4304] [client 20.91.231.89:17799] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "acZaeZLjeJUC3OKtEx87cQAAAUk"]
[Fri Mar 27 18:22:49.799884 2026] [:error] [pid 4293:tid 4311] [client 20.91.231.89:8308] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "acZaeZLjeJUC3OKtEx87dAAAAVA"]
[Fri Mar 27 18:22:50.348075 2026] [:error] [pid 4293:tid 4307] [client 20.91.231.89:18589] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class19.php"] [unique_id "acZaepLjeJUC3OKtEx87egAAAUw"]
[Fri Mar 27 18:22:50.902743 2026] [:error] [pid 4341:tid 4362] [client 20.91.231.89:13570] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "acZaeuKJWrNB5dMlERF7sQAAAZM"]
[Fri Mar 27 18:22:51.455443 2026] [:error] [pid 4341:tid 4364] [client 20.91.231.89:10030] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "acZae-KJWrNB5dMlERF7sgAAAZU"]
[Fri Mar 27 18:22:52.001192 2026] [:error] [pid 4293:tid 4307] [client 20.91.231.89:39351] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "acZafJLjeJUC3OKtEx87hgAAAUw"]
[Fri Mar 27 18:22:52.532105 2026] [:error] [pid 4293:tid 4306] [client 20.91.231.89:55010] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fffff.php"] [unique_id "acZafJLjeJUC3OKtEx87iQAAAUs"]
[Fri Mar 27 18:22:53.074468 2026] [:error] [pid 4293:tid 4300] [client 20.91.231.89:21652] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "acZafZLjeJUC3OKtEx87kwAAAUU"]
[Fri Mar 27 18:22:53.618492 2026] [:error] [pid 4293:tid 4308] [client 20.91.231.89:22782] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "acZafZLjeJUC3OKtEx87mQAAAU0"]
[Fri Mar 27 18:22:54.186102 2026] [:error] [pid 4341:tid 4346] [client 20.91.231.89:8377] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "acZafuKJWrNB5dMlERF7uAAAAYM"]
[Fri Mar 27 18:22:54.764950 2026] [:error] [pid 4293:tid 4317] [client 20.91.231.89:13599] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/thh.php"] [unique_id "acZafpLjeJUC3OKtEx87owAAAVY"]
[Fri Mar 27 18:22:55.326497 2026] [:error] [pid 4341:tid 4358] [client 20.91.231.89:13628] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "acZaf-KJWrNB5dMlERF7vgAAAY8"]
[Fri Mar 27 18:22:55.866500 2026] [:error] [pid 63897:tid 63914] [client 20.91.231.89:21637] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "acZaf2VSkmYmLu7ycYgyEQAAAQ8"]
[Fri Mar 27 18:22:56.421924 2026] [:error] [pid 27743:tid 27784] [client 20.91.231.89:51085] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "acZagCA46UYYLqzw99CxXgAAABQ"]
[Fri Mar 27 18:22:56.969605 2026] [:error] [pid 4293:tid 4298] [client 20.91.231.89:18573] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/yellow.php"] [unique_id "acZagJLjeJUC3OKtEx87qQAAAUM"]
[Fri Mar 27 18:22:57.528947 2026] [:error] [pid 63897:tid 63923] [client 20.91.231.89:21681] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acZagWVSkmYmLu7ycYgyFwAAARg"]
[Fri Mar 27 18:22:58.115250 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:5071] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acZagiA46UYYLqzw99CxZAAAAAc"]
[Fri Mar 27 18:22:58.698857 2026] [:error] [pid 27851:tid 27871] [client 20.91.231.89:8336] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acZagnR2ccxe3RMCLbrX5QAAAM0"]
[Fri Mar 27 18:22:59.248618 2026] [:error] [pid 4341:tid 4349] [client 20.91.231.89:22736] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/class20.php"] [unique_id "acZag-KJWrNB5dMlERF7wgAAAYY"]
[Fri Mar 27 18:22:59.799267 2026] [:error] [pid 27750:tid 27818] [client 20.91.231.89:39304] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "acZag4aSil5rd17ieLzdtAAAAIA"]
[Fri Mar 27 18:23:00.335295 2026] [:error] [pid 27749:tid 27797] [client 20.91.231.89:31283] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "acZahMEqyoMni2Q6_X7h_AAAAEY"]
[Fri Mar 27 18:23:00.909078 2026] [:error] [pid 27750:tid 27839] [client 20.91.231.89:8318] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "acZahIaSil5rd17ieLzdtwAAAJU"]
[Fri Mar 27 18:23:01.433667 2026] [:error] [pid 27749:tid 27805] [client 20.91.231.89:10022] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "acZahcEqyoMni2Q6_X7iAQAAAE4"]
[Fri Mar 27 18:23:02.027067 2026] [:error] [pid 27743:tid 27776] [client 20.91.231.89:45315] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "acZahiA46UYYLqzw99CxawAAAAw"]
[Fri Mar 27 18:23:02.575272 2026] [:error] [pid 4293:tid 4317] [client 20.91.231.89:18611] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "acZahpLjeJUC3OKtEx87sQAAAVY"]
[Fri Mar 27 18:23:03.133954 2026] [:error] [pid 4293:tid 4305] [client 20.91.231.89:45348] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "acZah5LjeJUC3OKtEx87twAAAUo"]
[Fri Mar 27 18:23:03.699364 2026] [:error] [pid 4293:tid 4295] [client 20.91.231.89:15595] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ffile.php"] [unique_id "acZah5LjeJUC3OKtEx87vAAAAUA"]
[Fri Mar 27 18:23:04.250432 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:55032] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vee.php"] [unique_id "acZaiCA46UYYLqzw99CxcQAAAAc"]
[Fri Mar 27 18:23:04.808608 2026] [:error] [pid 4341:tid 4343] [client 20.91.231.89:39324] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vee.php"] [unique_id "acZaiOKJWrNB5dMlERF7zAAAAYA"]
[Fri Mar 27 18:23:05.345461 2026] [:error] [pid 27743:tid 27774] [client 20.91.231.89:4888] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vee.php"] [unique_id "acZaiSA46UYYLqzw99CxdgAAAAo"]
[Fri Mar 27 18:23:05.881944 2026] [:error] [pid 27743:tid 27788] [client 20.91.231.89:5070] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/vee.php"] [unique_id "acZaiSA46UYYLqzw99CxfAAAABg"]
[Fri Mar 27 18:23:06.462728 2026] [:error] [pid 27743:tid 27780] [client 20.91.231.89:7349] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efile.php"] [unique_id "acZaiiA46UYYLqzw99CxhQAAABA"]
[Fri Mar 27 18:23:07.009027 2026] [:error] [pid 4293:tid 4303] [client 20.91.231.89:22732] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efile.php"] [unique_id "acZai5LjeJUC3OKtEx87yAAAAUg"]
[Fri Mar 27 18:23:07.566594 2026] [:error] [pid 27750:tid 27819] [client 20.91.231.89:4923] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efile.php"] [unique_id "acZai4aSil5rd17ieLzdvgAAAIE"]
[Fri Mar 27 18:23:08.115012 2026] [:error] [pid 27749:tid 27800] [client 20.91.231.89:37343] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/efile.php"] [unique_id "acZajMEqyoMni2Q6_X7iCQAAAEk"]
[Fri Mar 27 18:23:08.656130 2026] [:error] [pid 63897:tid 63918] [client 20.91.231.89:19112] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/afile.php"] [unique_id "acZajGVSkmYmLu7ycYgyIwAAARM"]
[Fri Mar 27 18:23:09.214606 2026] [:error] [pid 4293:tid 4300] [client 20.91.231.89:15568] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/afile.php"] [unique_id "acZajZLjeJUC3OKtEx870AAAAUU"]
[Fri Mar 27 18:23:09.748702 2026] [:error] [pid 63897:tid 63911] [client 20.91.231.89:39329] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/afile.php"] [unique_id "acZajWVSkmYmLu7ycYgyKAAAAQw"]
[Fri Mar 27 18:23:10.287352 2026] [:error] [pid 27743:tid 27767] [client 20.91.231.89:15593] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/afile.php"] [unique_id "acZajiA46UYYLqzw99CxjgAAAAM"]
[Fri Mar 27 18:23:10.829150 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:10525] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "acZajpLjeJUC3OKtEx871AAAAVI"]
[Fri Mar 27 18:23:11.387511 2026] [:error] [pid 63897:tid 63908] [client 20.91.231.89:10044] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "acZaj2VSkmYmLu7ycYgyLAAAAQk"]
[Fri Mar 27 18:23:11.936054 2026] [:error] [pid 4341:tid 4343] [client 20.91.231.89:31292] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "acZaj-KJWrNB5dMlERF72wAAAYA"]
[Fri Mar 27 18:23:12.486065 2026] [:error] [pid 63897:tid 63909] [client 20.91.231.89:19112] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lites.php"] [unique_id "acZakGVSkmYmLu7ycYgyMwAAAQo"]
[Fri Mar 27 18:23:13.022999 2026] [:error] [pid 27749:tid 27796] [client 20.91.231.89:55018] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "acZakcEqyoMni2Q6_X7iDAAAAEU"]
[Fri Mar 27 18:23:13.574012 2026] [:error] [pid 27749:tid 27808] [client 20.91.231.89:19090] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "acZakcEqyoMni2Q6_X7iDwAAAFE"]
[Fri Mar 27 18:23:14.134776 2026] [:error] [pid 27750:tid 27829] [client 20.91.231.89:45363] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "acZakoaSil5rd17ieLzdyAAAAIs"]
[Fri Mar 27 18:23:14.678071 2026] [:error] [pid 27743:tid 27766] [client 20.91.231.89:36631] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/0x.php"] [unique_id "acZakiA46UYYLqzw99CxlQAAAAI"]
[Fri Mar 27 18:23:15.237426 2026] [:error] [pid 27743:tid 27774] [client 20.91.231.89:31290] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "acZakyA46UYYLqzw99CxnQAAAAo"]
[Fri Mar 27 18:23:15.783858 2026] [:error] [pid 4293:tid 4295] [client 20.91.231.89:31876] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "acZak5LjeJUC3OKtEx872QAAAUA"]
[Fri Mar 27 18:23:16.344921 2026] [:error] [pid 4293:tid 4296] [client 20.91.231.89:4924] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "acZalJLjeJUC3OKtEx873wAAAUE"]
[Fri Mar 27 18:23:16.919050 2026] [:error] [pid 4293:tid 4311] [client 20.91.231.89:15578] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless3.php"] [unique_id "acZalJLjeJUC3OKtEx875wAAAVA"]
[Fri Mar 27 18:23:17.464479 2026] [:error] [pid 4293:tid 4295] [client 20.91.231.89:15523] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/enclas.php"] [unique_id "acZalZLjeJUC3OKtEx878AAAAUA"]
[Fri Mar 27 18:23:18.002889 2026] [:error] [pid 27743:tid 27783] [client 20.91.231.89:12570] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/enclas.php"] [unique_id "acZaliA46UYYLqzw99CxpQAAABM"]
[Fri Mar 27 18:23:18.558421 2026] [:error] [pid 4293:tid 4315] [client 20.91.231.89:15510] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/enclas.php"] [unique_id "acZalpLjeJUC3OKtEx87-gAAAVQ"]
[Fri Mar 27 18:23:19.119112 2026] [:error] [pid 4293:tid 4316] [client 20.91.231.89:15601] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/enclas.php"] [unique_id "acZal5LjeJUC3OKtEx87_gAAAVU"]
[Fri Mar 27 18:23:19.686567 2026] [:error] [pid 4293:tid 4317] [client 20.91.231.89:10509] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "acZal5LjeJUC3OKtEx88AwAAAVY"]
[Fri Mar 27 18:23:20.239639 2026] [:error] [pid 27750:tid 27821] [client 20.91.231.89:15570] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "acZamIaSil5rd17ieLzdzwAAAIM"]
[Fri Mar 27 18:23:20.772519 2026] [:error] [pid 27743:tid 27766] [client 20.91.231.89:15752] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "acZamCA46UYYLqzw99CxpwAAAAI"]
[Fri Mar 27 18:23:21.299130 2026] [:error] [pid 27750:tid 27829] [client 20.91.231.89:22757] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/he.php"] [unique_id "acZamYaSil5rd17ieLzd0wAAAIs"]
[Fri Mar 27 18:23:21.836252 2026] [:error] [pid 27750:tid 27836] [client 20.91.231.89:15798] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "acZamYaSil5rd17ieLzd1QAAAJI"]
[Fri Mar 27 18:23:22.383605 2026] [:error] [pid 27743:tid 27782] [client 20.91.231.89:10556] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "acZamiA46UYYLqzw99CxqgAAABI"]
[Fri Mar 27 18:23:22.910573 2026] [:error] [pid 27750:tid 27822] [client 20.91.231.89:16773] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "acZamoaSil5rd17ieLzd1gAAAIQ"]
[Fri Mar 27 18:23:23.476548 2026] [:error] [pid 63897:tid 63905] [client 20.91.231.89:11065] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/aves.php"] [unique_id "acZam2VSkmYmLu7ycYgyOwAAAQY"]
[Fri Mar 27 18:23:24.051142 2026] [:error] [pid 4293:tid 4305] [client 20.91.231.89:16770] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "acZanJLjeJUC3OKtEx88JAAAAUo"]
[Fri Mar 27 18:23:24.578843 2026] [:error] [pid 27743:tid 27785] [client 20.91.231.89:22717] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "acZanCA46UYYLqzw99CxsgAAABU"]
[Fri Mar 27 18:23:25.136021 2026] [:error] [pid 27743:tid 27775] [client 20.91.231.89:22783] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "acZanSA46UYYLqzw99CxtgAAAAs"]
[Fri Mar 27 18:23:25.685000 2026] [:error] [pid 27743:tid 27771] [client 20.91.231.89:16808] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cabs.php"] [unique_id "acZanSA46UYYLqzw99CxvAAAAAc"]
[Fri Mar 27 18:23:26.266596 2026] [:error] [pid 27743:tid 27770] [client 20.91.231.89:37259] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "acZaniA46UYYLqzw99CxwQAAAAY"]
[Fri Mar 27 18:23:26.813109 2026] [:error] [pid 4293:tid 4302] [client 20.91.231.89:15793] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "acZanpLjeJUC3OKtEx88JwAAAUc"]
[Fri Mar 27 18:23:27.346888 2026] [:error] [pid 27743:tid 27786] [client 20.91.231.89:15573] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "acZanyA46UYYLqzw99CxzAAAABY"]
[Fri Mar 27 18:23:27.915768 2026] [:error] [pid 27851:tid 27860] [client 20.91.231.89:11060] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file88.php"] [unique_id "acZan3R2ccxe3RMCLbrX_AAAAMI"]
[Fri Mar 27 18:23:28.461136 2026] [:error] [pid 4341:tid 4365] [client 20.91.231.89:15512] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acZaoOKJWrNB5dMlERF77gAAAZY"]
[Fri Mar 27 18:23:29.008819 2026] [:error] [pid 63897:tid 63903] [client 20.91.231.89:20625] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acZaoWVSkmYmLu7ycYgyRgAAAQQ"]
[Fri Mar 27 18:23:29.545040 2026] [:error] [pid 4293:tid 4312] [client 20.91.231.89:21703] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acZaoZLjeJUC3OKtEx88LQAAAVE"]
[Fri Mar 27 18:23:30.094689 2026] [:error] [pid 4341:tid 4348] [client 20.91.231.89:15600] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "acZaouKJWrNB5dMlERF78wAAAYU"]
[Fri Mar 27 18:23:30.642509 2026] [:error] [pid 27851:tid 27866] [client 20.91.231.89:21739] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x1da.php"] [unique_id "acZaonR2ccxe3RMCLbrX_gAAAMg"]
[Fri Mar 27 18:23:31.186037 2026] [:error] [pid 63897:tid 63915] [client 20.91.231.89:45366] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x1da.php"] [unique_id "acZao2VSkmYmLu7ycYgyTAAAARA"]
[Fri Mar 27 18:23:31.716771 2026] [:error] [pid 27851:tid 27862] [client 20.91.231.89:14233] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x1da.php"] [unique_id "acZao3R2ccxe3RMCLbrYBQAAAMQ"]
[Fri Mar 27 18:23:32.254700 2026] [:error] [pid 27851:tid 27870] [client 20.91.231.89:15517] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x1da.php"] [unique_id "acZapHR2ccxe3RMCLbrYBgAAAMw"]
[Fri Mar 27 18:23:32.784880 2026] [:error] [pid 4293:tid 4300] [client 20.91.231.89:14245] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/des.php"] [unique_id "acZapJLjeJUC3OKtEx88OQAAAUU"]
[Fri Mar 27 18:23:33.337628 2026] [:error] [pid 4293:tid 4306] [client 20.91.231.89:11032] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/des.php"] [unique_id "acZapZLjeJUC3OKtEx88PwAAAUs"]
[Fri Mar 27 18:23:33.863821 2026] [:error] [pid 4293:tid 4316] [client 20.91.231.89:20651] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/des.php"] [unique_id "acZapZLjeJUC3OKtEx88RgAAAVU"]
[Fri Mar 27 18:23:34.412134 2026] [:error] [pid 4293:tid 4313] [client 20.91.231.89:11027] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/des.php"] [unique_id "acZappLjeJUC3OKtEx88SwAAAVI"]
[Fri Mar 27 18:23:34.966978 2026] [:error] [pid 63897:tid 63908] [client 20.91.231.89:51077] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "acZapmVSkmYmLu7ycYgyVwAAAQk"]
[Fri Mar 27 18:23:35.491331 2026] [:error] [pid 4293:tid 4300] [client 20.91.231.89:15525] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "acZap5LjeJUC3OKtEx88UgAAAUU"]
[Fri Mar 27 18:23:36.057921 2026] [:error] [pid 4293:tid 4297] [client 20.91.231.89:15580] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "acZaqJLjeJUC3OKtEx88WQAAAUI"]
[Fri Mar 27 18:23:36.642289 2026] [:error] [pid 4293:tid 4307] [client 20.91.231.89:10754] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kaza.php"] [unique_id "acZaqJLjeJUC3OKtEx88XgAAAUw"]
[Fri Mar 27 18:23:37.186846 2026] [:error] [pid 27749:tid 27806] [client 20.91.231.89:31928] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file51.php"] [unique_id "acZaqcEqyoMni2Q6_X7iMQAAAE8"]
[Fri Mar 27 18:23:37.718714 2026] [:error] [pid 4293:tid 4301] [client 20.91.231.89:45370] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file51.php"] [unique_id "acZaqZLjeJUC3OKtEx88aAAAAUY"]
[Fri Mar 27 18:23:38.252925 2026] [:error] [pid 27851:tid 27869] [client 20.91.231.89:15795] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file51.php"] [unique_id "acZaqnR2ccxe3RMCLbrYCwAAAMs"]
[Fri Mar 27 18:23:38.778119 2026] [:error] [pid 4293:tid 4295] [client 20.91.231.89:22769] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file51.php"] [unique_id "acZaqpLjeJUC3OKtEx88cQAAAUA"]
[Fri Mar 27 18:23:39.316490 2026] [:error] [pid 4341:tid 4348] [client 20.91.231.89:37300] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blurbs15.php"] [unique_id "acZaq-KJWrNB5dMlERF8AQAAAYU"]
[Fri Mar 27 18:23:39.851746 2026] [:error] [pid 4293:tid 4302] [client 20.91.231.89:8315] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blurbs15.php"] [unique_id "acZaq5LjeJUC3OKtEx88egAAAUc"]
[Fri Mar 27 18:23:40.377832 2026] [:error] [pid 4293:tid 4297] [client 20.91.231.89:37287] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blurbs15.php"] [unique_id "acZarJLjeJUC3OKtEx88gwAAAUI"]
[Fri Mar 27 18:23:40.923963 2026] [:error] [pid 4341:tid 4367] [client 20.91.231.89:10559] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blurbs15.php"] [unique_id "acZarOKJWrNB5dMlERF8BQAAAZg"]
[Fri Mar 27 18:23:41.473916 2026] [:error] [pid 27851:tid 27866] [client 20.91.231.89:4167] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless11.php"] [unique_id "acZarXR2ccxe3RMCLbrYDgAAAMg"]
[Fri Mar 27 18:23:42.005708 2026] [:error] [pid 27851:tid 27879] [client 20.91.231.89:51077] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless11.php"] [unique_id "acZarnR2ccxe3RMCLbrYEQAAANU"]
[Fri Mar 27 18:23:42.547294 2026] [:error] [pid 4341:tid 4343] [client 20.91.231.89:16118] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless11.php"] [unique_id "acZaruKJWrNB5dMlERF8EAAAAYA"]
[Fri Mar 27 18:23:43.086267 2026] [:error] [pid 27851:tid 27881] [client 20.91.231.89:31906] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bless11.php"] [unique_id "acZar3R2ccxe3RMCLbrYFAAAANc"]
[Fri Mar 27 18:23:43.651461 2026] [:error] [pid 4293:tid 4298] [client 20.91.231.89:4196] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/security.php"] [unique_id "acZar5LjeJUC3OKtEx88igAAAUM"]
[Fri Mar 27 18:23:44.217964 2026] [:error] [pid 4293:tid 4302] [client 20.91.231.89:15760] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/security.php"] [unique_id "acZasJLjeJUC3OKtEx88jQAAAUc"]
[Fri Mar 27 18:23:44.783003 2026] [:error] [pid 27750:tid 27840] [client 20.91.231.89:8138] [client 20.91.231.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/security.php"] [unique_id "acZasIaSil5rd17ieLzd8gAAAJY"]
[Fri Mar 27 19:07:48.658593 2026] [:error] [pid 63897:tid 63914] [client 43.153.73.200:52910] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acZlBGVSkmYmLu7ycYg9pAAAAQ8"]
[Fri Mar 27 21:22:29.318437 2026] [:error] [pid 63897:tid 63915] [client 180.243.1.167:58431] [client 180.243.1.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.243.1.167, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acaElWVSkmYmLu7ycYhicwAAARA"]
[Fri Mar 27 21:22:40.964374 2026] [:error] [pid 27851:tid 27875] [client 170.106.35.153:41776] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acaEoHR2ccxe3RMCLbr-ewAAANE"]
[Fri Mar 27 22:57:07.565120 2026] [:error] [pid 54663:tid 54671] [client 217.216.37.53:61229] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acaawxUtStIXFk9WHe3gLQAAAcU"]
[Fri Mar 27 22:57:09.256863 2026] [:error] [pid 27851:tid 27874] [client 217.216.37.53:60854] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "acaaxXR2ccxe3RMCLboWSAAAANA"]
[Fri Mar 27 22:57:09.468941 2026] [:error] [pid 27749:tid 27806] [client 217.216.37.53:59439] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "acaaxcEqyoMni2Q6_X4dwgAAAE8"]
[Fri Mar 27 23:49:42.671641 2026] [:error] [pid 27749:tid 27801] [client 43.130.9.111:40316] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acanFsEqyoMni2Q6_X4uRAAAAEo"]
[Sat Mar 28 03:13:44.051068 2026] [:error] [pid 51655:tid 51662] [client 88.180.187.72:47961] [client 88.180.187.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.180.187.72, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acbW6H4PB5Q8y9C2Z9XXngAAAUU"]
[Sat Mar 28 03:32:44.644661 2026] [:error] [pid 51655:tid 51673] [client 39.33.5.126:63158] [client 39.33.5.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.33.5.126, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acbbXH4PB5Q8y9C2Z9XdRAAAAVA"]
[Sat Mar 28 07:26:33.976134 2026] [:error] [pid 64861:tid 64945] [client 20.197.29.71:15201] [client 20.197.29.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.197.29.71, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "accSKexK22_lUN2kvnVijAAAAIo"]
[Sat Mar 28 09:36:58.894772 2026] [:error] [pid 43579:tid 43631] [client 20.220.13.237:65142] [client 20.220.13.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accwuiRqN4JVI8gB7AmnXAAAApc"]
[Sat Mar 28 09:37:00.329909 2026] [:error] [pid 34597:tid 34615] [client 20.220.13.237:65474] [client 20.220.13.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accwvIluI7-e5s1cafc8sQAAAU4"]
[Sat Mar 28 09:37:01.756529 2026] [:error] [pid 64860:tid 64910] [client 20.220.13.237:65122] [client 20.220.13.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accwvRkU3N0pg_4aEL8X6AAAAEI"]
[Sat Mar 28 09:37:03.180264 2026] [:error] [pid 64861:tid 64954] [client 20.220.13.237:65442] [client 20.220.13.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accwv-xK22_lUN2kvnWTzgAAAJM"]
[Sat Mar 28 09:46:47.484920 2026] [:error] [pid 34631:tid 34664] [client 170.106.180.139:51076] [client 170.106.180.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acczBztzjMMS6kojpeRdLAAAAcQ"]
[Sat Mar 28 10:16:57.186157 2026] [:error] [pid 64860:tid 64914] [client 203.2.64.59:34980] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acc6GRkU3N0pg_4aEL8kQAAAAEY"]
[Sat Mar 28 13:21:56.240449 2026] [:error] [pid 64859:tid 64891] [client 49.43.133.19:62436] [client 49.43.133.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.133.19, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acdldG3qEBHXq3rHdBnU8QAAAAo"]
[Sat Mar 28 13:27:33.430302 2026] [:error] [pid 64860:tid 64932] [client 150.109.230.210:40928] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acdmxRkU3N0pg_4aEL9Y8wAAAFg"]
[Sat Mar 28 19:08:51.358815 2026] [:error] [pid 34631:tid 34667] [client 43.166.244.66:49604] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ace2wztzjMMS6kojpeQs5gAAAcc"]
[Sat Mar 28 20:23:28.282158 2026] [:error] [pid 64860:tid 64922] [client 109.132.10.49:62841] [client 109.132.10.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.132.10.49, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acfIQBkU3N0pg_4aEL-axQAAAE4"]
[Sat Mar 28 21:28:03.820420 2026] [:error] [pid 64860:tid 64925] [client 43.156.202.34:58248] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acfXYxkU3N0pg_4aEL-kxwAAAFE"]
[Sat Mar 28 23:54:52.748094 2026] [:error] [pid 64861:tid 64938] [client 43.157.149.188:42914] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acf5zOxK22_lUN2kvnW--wAAAIM"]
[Sat Mar 28 23:55:14.578186 2026] [:error] [pid 43579:tid 43624] [client 150.228.3.245:22493] [client 150.228.3.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.3.245, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acf54iRqN4JVI8gB7AkPdQAAApA"]
[Sun Mar 29 03:20:52.230698 2026] [:error] [pid 39429:tid 39500] [client 43.155.27.244:37988] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acgqFE8pSj6sqgZaItn4TAAAAI4"]
[Sun Mar 29 07:00:54.225433 2026] [:error] [pid 32255:tid 32294] [client 43.159.143.139:56608] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "achdpmnfn-AtRoMbquxnHgAAAEM"]
[Sun Mar 29 10:28:26.234548 2026] [:error] [pid 32257:tid 32319] [client 43.135.211.148:60630] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aciOSiE3TArOFrUtgWpx3wAAAIE"]
[Sun Mar 29 13:13:10.686295 2026] [:error] [pid 32255:tid 32306] [client 174.234.135.221:2643] [client 174.234.135.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.234.135.221, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aci05mnfn-AtRoMbquz_UwAAAE8"]
[Sun Mar 29 13:21:27.240929 2026] [:error] [pid 23167:tid 23194] [client 43.131.253.14:60730] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aci21xIAHJCFaHff3_cNSQAAAdg"]
[Sun Mar 29 15:39:23.759613 2026] [:error] [pid 32257:tid 32330] [client 1.15.52.154:43684] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acjXKyE3TArOFrUtgWqjugAAAIw"]
[Sun Mar 29 17:07:42.491960 2026] [:error] [pid 23167:tid 23177] [client 188.25.252.114:18441] [client 188.25.252.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.25.252.114, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acjr3hIAHJCFaHff3_dnvAAAAcc"]
[Sun Mar 29 18:39:10.175212 2026] [:error] [pid 32255:tid 32299] [client 147.93.93.184:25420] [client 147.93.93.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "ackBTmnfn-AtRoMbquyjdgAAAEg"]
[Sun Mar 29 18:45:32.778498 2026] [:error] [pid 23137:tid 23143] [client 43.130.111.40:54634] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ackCzBaWQa7LdZ_qGFbhegAAAYQ"]
[Sun Mar 29 23:07:26.466726 2026] [:error] [pid 23284:tid 23291] [client 192.144.148.122:35214] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aclALozBujdPHsq7wyTXKQAAAoU"]
[Mon Mar 30 01:53:41.728799 2026] [:error] [pid 32257:tid 32327] [client 20.114.151.189:30510] [client 20.114.151.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.114.151.189, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aclnJSE3TArOFrUtgWrXrgAAAIk"]
[Mon Mar 30 01:53:44.906509 2026] [:error] [pid 32257:tid 32319] [client 20.114.151.189:30510] [client 20.114.151.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.114.151.189, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aclnKCE3TArOFrUtgWrXwwAAAIE"]
[Mon Mar 30 01:53:48.098353 2026] [:error] [pid 32257:tid 32318] [client 20.114.151.189:30510] [client 20.114.151.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aclnLCE3TArOFrUtgWrX6AAAAIA"]
[Mon Mar 30 04:32:26.117806 2026] [:error] [pid 4033:tid 4062] [client 181.115.120.139:36863] [client 181.115.120.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.115.120.139, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acmMWqnf-DXI9VblHi1AwwAAAAk"]
[Mon Mar 30 04:41:10.993940 2026] [:error] [pid 55884:tid 55956] [client 43.135.211.148:52650] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acmOZjjuYLVkve3Vbhx-tgAAAQM"]
[Mon Mar 30 10:09:26.971902 2026] [:error] [pid 35250:tid 35334] [client 43.156.109.53:48738] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acnbVoaKM1MR6zcp2YOGdwAAANc"]
[Mon Mar 30 12:45:40.042299 2026] [:error] [pid 35343:tid 35364] [client 43.157.22.109:60738] [client 43.157.22.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acn_9KP5HurqmbvwN-KSDQAAABM"]
[Mon Mar 30 13:44:08.919595 2026] [:error] [pid 35248:tid 35264] [client 178.218.130.7:61248] [client 178.218.130.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "acoNqL3igMCgAQPFS_9JYgAAAEo"]
[Mon Mar 30 14:30:38.569049 2026] [:error] [pid 35343:tid 35365] [client 20.212.0.99:6869] [client 20.212.0.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "acoYjqP5HurqmbvwN-LLhgAAABQ"]
[Mon Mar 30 15:16:22.674020 2026] [:error] [pid 50663:tid 50673] [client 43.166.250.187:40966] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acojRm28b9DKIAMEdfDncQAAAYg"]
[Mon Mar 30 20:14:11.328677 2026] [:error] [pid 12046:tid 12073] [client 43.173.1.57:50860] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acppE5DbtlkoJ6ELn7gflwAAAlg"]
[Mon Mar 30 20:14:42.048312 2026] [:error] [pid 35249:tid 35299] [client 94.110.159.107:16801] [client 94.110.159.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.110.159.107, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acppMiqCKiTq85d6rgBYYgAAAI8"]
[Mon Mar 30 20:17:08.637457 2026] [:error] [pid 50663:tid 50671] [client 103.92.212.22:55024] [client 103.92.212.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.92.212.22, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acppxG28b9DKIAMEdfA3awAAAYY"]
[Mon Mar 30 22:33:49.305505 2026] [:error] [pid 63557:tid 63579] [client 43.155.129.131:52232] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acqJza4QNVlzYgEvIjmdQwAAARQ"]
[Tue Mar 31 00:12:19.710181 2026] [:error] [pid 31705:tid 31726] [client 98.159.37.243:64925] [client 98.159.37.243] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "acqg47h0Asyt0lXzJSw5_QAAAhM"]
[Tue Mar 31 00:12:53.574059 2026] [:error] [pid 31577:tid 31580] [client 20.111.17.29:18402] [client 20.111.17.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "acqhBXOcPMUnrUQjB4JX9gAAAYE"]
[Tue Mar 31 00:13:06.797080 2026] [:error] [pid 60745:tid 60751] [client 20.111.17.29:18324] [client 20.111.17.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "acqhEiQDBn75QnHaPb9jUQAAAEI"]
[Tue Mar 31 00:13:07.746289 2026] [:error] [pid 31735:tid 31743] [client 20.111.17.29:18375] [client 20.111.17.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "acqhEz-CFgIllBeFWWFMwAAAAkY"]
[Tue Mar 31 00:13:09.190315 2026] [:error] [pid 60746:tid 60794] [client 20.111.17.29:18400] [client 20.111.17.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acqhFZ4kQrgjDdAbQCpCWwAAAJI"]
[Tue Mar 31 00:13:10.620083 2026] [:error] [pid 60746:tid 60795] [client 20.111.17.29:18418] [client 20.111.17.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "acqhFp4kQrgjDdAbQCpCXwAAAJM"]
[Tue Mar 31 00:13:32.930868 2026] [proxy_fcgi:error] [pid 60747:tid 60822] [client 20.111.17.29:18421] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 00:13:51.878163 2026] [:error] [pid 60747:tid 60822] [client 20.111.17.29:18421] [client 20.111.17.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.111.17.29, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acqhPwU3IY-cCpy_-zFddQAAANM"]
[Tue Mar 31 00:55:35.104105 2026] [:error] [pid 36939:tid 36954] [client 43.166.226.186:54716] [client 43.166.226.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acqrB8RDKH225Jeq1jcrVgAAAA0"]
[Tue Mar 31 03:54:25.377095 2026] [:error] [pid 18334:tid 18421] [client 185.223.152.174:65009] [client 185.223.152.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.174, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acrU8XqQrXLbk1cg3mgKdgAAAI8"]
[Tue Mar 31 06:37:24.784607 2026] [:error] [pid 11869:tid 11887] [client 15.204.12.43:55365] [client 15.204.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "acr7JBvAVplg9I6KoIIqjgAAAc8"]
[Tue Mar 31 07:47:30.106978 2026] [:error] [pid 41421:tid 41427] [client 185.238.231.48:41359] [client 185.238.231.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.48, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acsLkhSaDjY9kKFtUQAwGwAAAQM"]
[Tue Mar 31 08:19:42.067793 2026] [:error] [pid 41421:tid 41436] [client 221.229.106.25:56276] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acsTHhSaDjY9kKFtUQBReAAAAQw"]
[Tue Mar 31 08:54:01.818020 2026] [:error] [pid 41421:tid 41443] [client 119.28.89.249:35100] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acsbKRSaDjY9kKFtUQBvxQAAARM"]
[Tue Mar 31 12:39:56.047812 2026] [:error] [pid 36890:tid 36895] [client 157.230.243.13:61822] [client 157.230.243.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "actQHJ8FASPd_uH8z7efNwAAAAA"]
[Tue Mar 31 16:42:51.053335 2026] [:error] [pid 6548:tid 6560] [client 43.153.12.58:51226] [client 43.153.12.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acuJC7gIz9HgMl9YwE6uQwAAAUo"]
[Tue Mar 31 17:43:17.736032 2026] [:error] [pid 36892:tid 36959] [client 172.70.248.103:11646] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/refs/heads/main"] [unique_id "acuXNUyj9S4G0ek3O4Jo-QAAAIg"]
[Tue Mar 31 17:43:17.758579 2026] [:error] [pid 36890:tid 36913] [client 172.70.248.57:12766] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "acuXNZ8FASPd_uH8z7cHugAAABI"]
[Tue Mar 31 17:43:17.787111 2026] [:error] [pid 6548:tid 6570] [client 172.70.248.35:9883] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/refs/heads/master"] [unique_id "acuXNbgIz9HgMl9YwE7bEQAAAVQ"]
[Tue Mar 31 17:43:17.815636 2026] [:error] [pid 6548:tid 6565] [client 172.70.248.34:10149] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "acuXNbgIz9HgMl9YwE7bEgAAAU8"]
[Tue Mar 31 17:43:17.881308 2026] [:error] [pid 36892:tid 36961] [client 172.70.248.78:13751] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/logs/HEAD"] [unique_id "acuXNUyj9S4G0ek3O4Jo-gAAAIo"]
[Tue Mar 31 17:43:17.886373 2026] [:error] [pid 41421:tid 41435] [client 172.70.248.79:11820] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/index"] [unique_id "acuXNRSaDjY9kKFtUQBfXAAAAQs"]
[Tue Mar 31 17:43:18.740606 2026] [:error] [pid 36890:tid 36899] [client 172.70.248.34:10152] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "acuXNp8FASPd_uH8z7cHvgAAAAQ"]
[Tue Mar 31 17:43:18.798109 2026] [:error] [pid 36892:tid 36964] [client 172.70.248.102:11764] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local"] [unique_id "acuXNkyj9S4G0ek3O4JpAQAAAI0"]
[Tue Mar 31 17:43:18.818398 2026] [:error] [pid 36890:tid 36898] [client 172.70.248.103:9300] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development"] [unique_id "acuXNp8FASPd_uH8z7cHwAAAAAM"]
[Tue Mar 31 17:43:18.818675 2026] [:error] [pid 41421:tid 41437] [client 172.70.248.79:11825] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production"] [unique_id "acuXNhSaDjY9kKFtUQBfXwAAAQ0"]
[Tue Mar 31 17:43:18.928901 2026] [:error] [pid 36892:tid 36952] [client 172.70.248.57:12771] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dev"] [unique_id "acuXNkyj9S4G0ek3O4JpBAAAAIE"]
[Tue Mar 31 17:43:18.946137 2026] [:error] [pid 36892:tid 36973] [client 172.70.248.35:9891] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test"] [unique_id "acuXNkyj9S4G0ek3O4JpBQAAAJY"]
[Tue Mar 31 17:43:19.733628 2026] [:error] [pid 41421:tid 41432] [client 172.70.248.79:11830] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging"] [unique_id "acuXNxSaDjY9kKFtUQBfYQAAAQg"]
[Tue Mar 31 17:43:19.795652 2026] [:error] [pid 6548:tid 6574] [client 172.70.248.35:9896] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup"] [unique_id "acuXN7gIz9HgMl9YwE7bFwAAAVg"]
[Tue Mar 31 17:43:19.822494 2026] [:error] [pid 6548:tid 6561] [client 172.70.248.78:13756] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.bak"] [unique_id "acuXN7gIz9HgMl9YwE7bGAAAAUs"]
[Tue Mar 31 17:43:19.845993 2026] [:error] [pid 6548:tid 6571] [client 172.70.248.78:13764] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old"] [unique_id "acuXN7gIz9HgMl9YwE7bGQAAAVU"]
[Tue Mar 31 17:43:19.968047 2026] [:error] [pid 6548:tid 6568] [client 172.70.248.78:13765] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.tmp"] [unique_id "acuXN7gIz9HgMl9YwE7bGgAAAVI"]
[Tue Mar 31 17:43:19.976779 2026] [:error] [pid 6548:tid 6560] [client 172.70.248.103:9305] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save"] [unique_id "acuXN7gIz9HgMl9YwE7bGwAAAUo"]
[Tue Mar 31 17:43:20.746220 2026] [:error] [pid 6548:tid 6569] [client 172.70.248.102:11765] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example"] [unique_id "acuXOLgIz9HgMl9YwE7bHgAAAVM"]
[Tue Mar 31 17:43:20.822266 2026] [:error] [pid 36890:tid 36917] [client 172.70.248.102:11770] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local"] [unique_id "acuXOJ8FASPd_uH8z7cHxwAAABY"]
[Tue Mar 31 17:43:20.832700 2026] [:error] [pid 36890:tid 36908] [client 172.70.248.56:11993] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local"] [unique_id "acuXOJ8FASPd_uH8z7cHyAAAAA0"]
[Tue Mar 31 17:43:20.874509 2026] [:error] [pid 36890:tid 36916] [client 172.70.248.34:10159] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env"] [unique_id "acuXOJ8FASPd_uH8z7cHyQAAABU"]
[Tue Mar 31 17:43:20.984210 2026] [:error] [pid 36892:tid 36969] [client 172.70.248.56:12001] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/backend/.env"] [unique_id "acuXOEyj9S4G0ek3O4JpFgAAAJI"]
[Tue Mar 31 17:43:20.999399 2026] [:error] [pid 36892:tid 36956] [client 172.70.248.79:11837] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "acuXOEyj9S4G0ek3O4JpFwAAAIU"]
[Tue Mar 31 17:43:21.745093 2026] [:error] [pid 6548:tid 6552] [client 172.70.248.34:10164] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "acuXObgIz9HgMl9YwE7bJQAAAUI"]
[Tue Mar 31 17:43:21.819740 2026] [:error] [pid 6548:tid 6568] [client 172.70.248.34:10169] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env"] [unique_id "acuXObgIz9HgMl9YwE7bJgAAAVI"]
[Tue Mar 31 17:43:21.843108 2026] [:error] [pid 6548:tid 6565] [client 172.70.248.35:9898] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/core/.env"] [unique_id "acuXObgIz9HgMl9YwE7bJwAAAU8"]
[Tue Mar 31 17:43:21.910867 2026] [:error] [pid 6548:tid 6567] [client 172.70.248.79:11839] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/public/.env"] [unique_id "acuXObgIz9HgMl9YwE7bKAAAAVE"]
[Tue Mar 31 17:43:21.986806 2026] [:error] [pid 41421:tid 41442] [client 172.70.248.102:11778] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/private/.env"] [unique_id "acuXORSaDjY9kKFtUQBfZwAAARI"]
[Tue Mar 31 17:43:22.751167 2026] [:error] [pid 36891:tid 36935] [client 172.70.248.34:10171] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env.local"] [unique_id "acuXOpJhiMaJUqoqfl6xZgAAAEs"]
[Tue Mar 31 17:43:22.831413 2026] [:error] [pid 36891:tid 36926] [client 172.70.248.56:12008] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.json"] [unique_id "acuXOpJhiMaJUqoqfl6xZwAAAEI"]
[Tue Mar 31 17:43:22.845577 2026] [:error] [pid 36891:tid 36930] [client 172.70.248.103:9310] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.php"] [unique_id "acuXOpJhiMaJUqoqfl6xaAAAAEY"]
[Tue Mar 31 17:43:22.904586 2026] [:error] [pid 6548:tid 6563] [client 172.70.248.35:9905] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_backup"] [unique_id "acuXOrgIz9HgMl9YwE7bLAAAAU0"]
[Tue Mar 31 17:43:23.005080 2026] [:error] [pid 36982:tid 36995] [client 172.70.248.103:9317] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env~"] [unique_id "acuXO_lMmeoQKN0r_GNQFwAAAMo"]
[Tue Mar 31 17:43:23.023168 2026] [:error] [pid 36892:tid 36952] [client 172.70.248.56:12012] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env1"] [unique_id "acuXO0yj9S4G0ek3O4JpJQAAAIE"]
[Tue Mar 31 17:43:23.107071 2026] [:error] [pid 36891:tid 36940] [client 172.70.248.103:9308] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.envrc"] [unique_id "acuXO5JhiMaJUqoqfl6xagAAAFA"]
[Tue Mar 31 17:43:23.774061 2026] [:error] [pid 41421:tid 41426] [client 172.70.248.57:12774] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env2"] [unique_id "acuXOxSaDjY9kKFtUQBfcAAAAQI"]
[Tue Mar 31 17:43:23.860074 2026] [:error] [pid 36892:tid 36965] [client 172.70.248.79:11842] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist"] [unique_id "acuXO0yj9S4G0ek3O4JpLAAAAI4"]
[Tue Mar 31 17:43:23.917322 2026] [:error] [pid 36892:tid 36959] [client 172.70.248.103:9321] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.orig"] [unique_id "acuXO0yj9S4G0ek3O4JpLQAAAIg"]
[Tue Mar 31 17:43:24.043592 2026] [:error] [pid 36890:tid 36915] [client 172.70.248.57:14038] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.bak"] [unique_id "acuXPJ8FASPd_uH8z7cHzgAAABQ"]
[Tue Mar 31 17:43:24.054645 2026] [:error] [pid 36890:tid 36910] [client 172.70.248.78:13773] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod"] [unique_id "acuXPJ8FASPd_uH8z7cH0AAAAA8"]
[Tue Mar 31 17:43:24.092796 2026] [:error] [pid 41421:tid 41425] [client 172.70.248.34:10172] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dev.local"] [unique_id "acuXPBSaDjY9kKFtUQBfcwAAAQE"]
[Tue Mar 31 17:43:24.800198 2026] [:error] [pid 36890:tid 36911] [client 172.70.248.57:14043] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker"] [unique_id "acuXPJ8FASPd_uH8z7cH0wAAABA"]
[Tue Mar 31 17:43:24.921715 2026] [:error] [pid 36982:tid 36986] [client 172.70.248.103:9326] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.container"] [unique_id "acuXPPlMmeoQKN0r_GNQGgAAAME"]
[Tue Mar 31 17:43:24.923338 2026] [:error] [pid 36982:tid 37007] [client 172.70.248.35:10596] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/docker/.env"] [unique_id "acuXPPlMmeoQKN0r_GNQGwAAANY"]
[Tue Mar 31 17:43:25.064333 2026] [:error] [pid 41421:tid 41438] [client 172.70.248.78:13777] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/docker/.env.local"] [unique_id "acuXPRSaDjY9kKFtUQBfdQAAAQ4"]
[Tue Mar 31 17:43:25.109850 2026] [:error] [pid 41421:tid 41436] [client 172.70.248.56:11506] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/server/.env"] [unique_id "acuXPRSaDjY9kKFtUQBfdwAAAQw"]
[Tue Mar 31 17:43:25.362205 2026] [:error] [pid 41421:tid 41429] [client 172.70.248.34:9576] [client 172.70.248.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/www/.env"] [unique_id "acuXPRSaDjY9kKFtUQBfeAAAAQU"]
[Tue Mar 31 17:43:25.952604 2026] [:error] [pid 36890:tid 36898] [client 172.70.248.35:10600] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/srv/.env"] [unique_id "acuXPZ8FASPd_uH8z7cH1gAAAAM"]
[Tue Mar 31 17:43:25.976970 2026] [:error] [pid 41421:tid 41434] [client 172.70.248.35:10601] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web/.env"] [unique_id "acuXPRSaDjY9kKFtUQBfewAAAQo"]
[Tue Mar 31 17:43:26.098013 2026] [:error] [pid 36892:tid 36959] [client 172.70.248.102:11786] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/site/.env"] [unique_id "acuXPkyj9S4G0ek3O4JpOwAAAIg"]
[Tue Mar 31 17:43:26.168615 2026] [:error] [pid 41421:tid 41445] [client 172.70.248.79:11848] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/var/www/.env"] [unique_id "acuXPhSaDjY9kKFtUQBffQAAARU"]
[Tue Mar 31 17:43:26.406575 2026] [:error] [pid 36982:tid 36992] [client 172.70.248.102:11793] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/var/www/html/.env"] [unique_id "acuXPvlMmeoQKN0r_GNQHgAAAMc"]
[Tue Mar 31 17:43:26.985318 2026] [:error] [pid 36982:tid 36989] [client 172.70.248.79:13588] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/root/.env"] [unique_id "acuXPvlMmeoQKN0r_GNQJAAAAMQ"]
[Tue Mar 31 17:43:27.098782 2026] [:error] [pid 36982:tid 36990] [client 172.70.248.102:11798] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_config"] [unique_id "acuXP_lMmeoQKN0r_GNQJgAAAMU"]
[Tue Mar 31 17:43:27.409284 2026] [:error] [pid 36982:tid 37005] [client 172.70.248.79:13594] [client 172.70.248.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_settings"] [unique_id "acuXP_lMmeoQKN0r_GNQKwAAANQ"]
[Tue Mar 31 17:43:27.600643 2026] [:error] [pid 36890:tid 36906] [client 172.70.248.102:13884] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "acuXP58FASPd_uH8z7cH1wAAAAs"]
[Tue Mar 31 17:43:27.923600 2026] [:error] [pid 36891:tid 36944] [client 172.70.248.57:12980] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "acuXP5JhiMaJUqoqfl6xbgAAAFQ"]
[Tue Mar 31 17:43:28.003013 2026] [:error] [pid 36982:tid 37009] [client 172.70.248.35:10608] [client 172.70.248.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local.backup"] [unique_id "acuXQPlMmeoQKN0r_GNQLwAAANg"]
[Tue Mar 31 17:43:28.109695 2026] [:error] [pid 36982:tid 36991] [client 172.70.248.78:9967] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/index"] [unique_id "acuXQPlMmeoQKN0r_GNQMAAAAMY"]
[Tue Mar 31 17:43:28.521926 2026] [:error] [pid 36890:tid 36913] [client 172.70.248.78:9974] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/refs/heads/master"] [unique_id "acuXQJ8FASPd_uH8z7cH2gAAABI"]
[Tue Mar 31 17:43:29.032492 2026] [:error] [pid 6548:tid 6552] [client 172.70.248.78:9975] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/refs/heads/main"] [unique_id "acuXQbgIz9HgMl9YwE7bOgAAAUI"]
[Tue Mar 31 17:43:29.542129 2026] [:error] [pid 36982:tid 37005] [client 172.70.248.56:9738] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "acuXQflMmeoQKN0r_GNQNQAAANQ"]
[Tue Mar 31 17:43:30.039098 2026] [:error] [pid 36890:tid 36915] [client 172.70.248.56:9743] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local"] [unique_id "acuXQp8FASPd_uH8z7cH3QAAABQ"]
[Tue Mar 31 17:43:45.229142 2026] [:error] [pid 41421:tid 41442] [client 172.70.248.102:9984] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development"] [unique_id "acuXURSaDjY9kKFtUQBfmQAAARI"]
[Tue Mar 31 17:43:45.750624 2026] [:error] [pid 41421:tid 41447] [client 172.70.248.102:9985] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dev"] [unique_id "acuXURSaDjY9kKFtUQBfngAAARc"]
[Tue Mar 31 17:43:46.362326 2026] [:error] [pid 36891:tid 36939] [client 172.70.248.57:10381] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging"] [unique_id "acuXUpJhiMaJUqoqfl6xmgAAAE8"]
[Tue Mar 31 17:43:46.882808 2026] [:error] [pid 36890:tid 36904] [client 172.70.248.102:9991] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup"] [unique_id "acuXUp8FASPd_uH8z7cH_wAAAAk"]
[Tue Mar 31 17:43:47.397457 2026] [:error] [pid 6548:tid 6550] [client 172.70.248.56:13385] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old"] [unique_id "acuXU7gIz9HgMl9YwE7bcgAAAUA"]
[Tue Mar 31 17:43:47.674390 2026] [:error] [pid 6548:tid 6572] [client 172.69.186.149:11696] [client 172.69.186.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save"] [unique_id "acuXU7gIz9HgMl9YwE7bcwAAAVY"]
[Tue Mar 31 17:43:47.920151 2026] [:error] [pid 36982:tid 36993] [client 172.70.248.103:10188] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.tmp"] [unique_id "acuXU_lMmeoQKN0r_GNQXgAAAMg"]
[Tue Mar 31 17:43:47.953186 2026] [:error] [pid 36891:tid 36943] [client 172.69.186.149:11703] [client 172.69.186.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example"] [unique_id "acuXU5JhiMaJUqoqfl6xogAAAFM"]
[Tue Mar 31 17:43:48.445467 2026] [:error] [pid 36890:tid 36916] [client 172.70.248.57:10389] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local"] [unique_id "acuXVJ8FASPd_uH8z7cIBwAAABU"]
[Tue Mar 31 17:43:48.474461 2026] [:error] [pid 36890:tid 36910] [client 172.70.248.78:9699] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env"] [unique_id "acuXVJ8FASPd_uH8z7cICAAAAA8"]
[Tue Mar 31 17:43:48.948581 2026] [:error] [pid 36890:tid 36900] [client 172.70.248.57:10393] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "acuXVJ8FASPd_uH8z7cIDQAAAAU"]
[Tue Mar 31 17:43:48.978981 2026] [:error] [pid 36891:tid 36940] [client 172.70.248.57:10400] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/backend/.env"] [unique_id "acuXVJJhiMaJUqoqfl6xpwAAAFA"]
[Tue Mar 31 17:43:49.443407 2026] [:error] [pid 36982:tid 37003] [client 172.70.248.103:10189] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "acuXVflMmeoQKN0r_GNQXwAAANI"]
[Tue Mar 31 17:43:49.484212 2026] [:error] [pid 36982:tid 36988] [client 172.70.248.102:11589] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/admin/.env"] [unique_id "acuXVflMmeoQKN0r_GNQYAAAAMM"]
[Tue Mar 31 17:43:49.771131 2026] [:error] [pid 36982:tid 36994] [client 172.69.186.11:14253] [client 172.69.186.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/private/.env"] [unique_id "acuXVflMmeoQKN0r_GNQYQAAAMk"]
[Tue Mar 31 17:43:49.937894 2026] [:error] [pid 36982:tid 37004] [client 172.70.248.56:13400] [client 172.70.248.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/public/.env"] [unique_id "acuXVflMmeoQKN0r_GNQZQAAANM"]
[Tue Mar 31 17:43:50.227156 2026] [:error] [pid 36892:tid 36974] [client 172.69.186.148:12995] [client 172.69.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env.local"] [unique_id "acuXVkyj9S4G0ek3O4JpxgAAAJc"]
[Tue Mar 31 17:43:50.574586 2026] [:error] [pid 36890:tid 36908] [client 172.69.186.149:14288] [client 172.69.186.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.json"] [unique_id "acuXVp8FASPd_uH8z7cIEQAAAA0"]
[Tue Mar 31 17:43:50.853447 2026] [:error] [pid 6548:tid 6564] [client 172.69.186.10:10437] [client 172.69.186.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_backup"] [unique_id "acuXVrgIz9HgMl9YwE7begAAAU4"]
[Tue Mar 31 17:43:51.137042 2026] [:error] [pid 36982:tid 37002] [client 172.69.186.148:12996] [client 172.69.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env~"] [unique_id "acuXV_lMmeoQKN0r_GNQZwAAANE"]
[Tue Mar 31 17:43:51.378714 2026] [:error] [pid 6548:tid 6571] [client 172.70.248.102:11593] [client 172.70.248.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env1"] [unique_id "acuXV7gIz9HgMl9YwE7bfgAAAVU"]
[Tue Mar 31 17:43:51.882701 2026] [:error] [pid 6548:tid 6567] [client 172.70.248.78:9702] [client 172.70.248.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env2"] [unique_id "acuXV7gIz9HgMl9YwE7bgAAAAVE"]
[Tue Mar 31 17:44:05.599001 2026] [:error] [pid 36982:tid 36995] [client 172.69.186.11:13536] [client 172.69.186.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.envrc"] [unique_id "acuXZflMmeoQKN0r_GNQswAAAMo"]
[Tue Mar 31 17:44:07.884410 2026] [:error] [pid 6548:tid 6554] [client 172.69.186.206:9521] [client 172.69.186.206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod"] [unique_id "acuXZ7gIz9HgMl9YwE7brwAAAUQ"]
[Tue Mar 31 17:44:08.379078 2026] [:error] [pid 41421:tid 41437] [client 172.70.248.103:12819] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dev.local"] [unique_id "acuXaBSaDjY9kKFtUQBfvwAAAQ0"]
[Tue Mar 31 17:44:08.668340 2026] [:error] [pid 36982:tid 36999] [client 172.69.186.206:9528] [client 172.69.186.206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker"] [unique_id "acuXaPlMmeoQKN0r_GNQvAAAAM4"]
[Tue Mar 31 17:44:09.635433 2026] [:error] [pid 6548:tid 6573] [client 172.70.248.57:12000] [client 172.70.248.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/docker/.env"] [unique_id "acuXabgIz9HgMl9YwE7bsgAAAVc"]
[Tue Mar 31 17:44:10.202513 2026] [:error] [pid 36892:tid 36973] [client 172.69.186.148:12830] [client 172.69.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.php"] [unique_id "acuXakyj9S4G0ek3O4Jp-gAAAJY"]
[Tue Mar 31 17:44:10.984540 2026] [:error] [pid 36982:tid 36988] [client 172.69.186.149:11649] [client 172.69.186.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/docker/.env.local"] [unique_id "acuXavlMmeoQKN0r_GNQwQAAAMM"]
[Tue Mar 31 17:44:28.640770 2026] [:error] [pid 6548:tid 6557] [client 172.69.186.157:13490] [client 172.69.186.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/www/.env"] [unique_id "acuXfLgIz9HgMl9YwE7b6AAAAUc"]
[Tue Mar 31 17:44:28.920680 2026] [:error] [pid 6548:tid 6561] [client 172.69.186.207:12727] [client 172.69.186.207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/var/www/.env"] [unique_id "acuXfLgIz9HgMl9YwE7b6QAAAUs"]
[Tue Mar 31 17:44:29.197517 2026] [:error] [pid 6548:tid 6554] [client 172.69.186.176:11101] [client 172.69.186.176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/var/www/html/.env"] [unique_id "acuXfbgIz9HgMl9YwE7b7AAAAUQ"]
[Tue Mar 31 17:44:29.688977 2026] [:error] [pid 36891:tid 36940] [client 172.70.248.103:13000] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/home/.env"] [unique_id "acuXfZJhiMaJUqoqfl6ybAAAAFA"]
[Tue Mar 31 17:44:29.986938 2026] [:error] [pid 36982:tid 36986] [client 172.69.186.148:10658] [client 172.69.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_config"] [unique_id "acuXfflMmeoQKN0r_GNRLQAAAME"]
[Tue Mar 31 17:44:30.125721 2026] [:error] [pid 36982:tid 37003] [client 172.70.248.103:13001] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/root/.env"] [unique_id "acuXfvlMmeoQKN0r_GNRLwAAANI"]
[Tue Mar 31 17:44:30.263426 2026] [:error] [pid 36982:tid 37006] [client 172.69.186.165:9876] [client 172.69.186.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_secret"] [unique_id "acuXfvlMmeoQKN0r_GNRMAAAANU"]
[Tue Mar 31 17:44:30.416910 2026] [:error] [pid 36982:tid 36994] [client 172.69.186.194:10467] [client 172.69.186.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env_settings"] [unique_id "acuXfvlMmeoQKN0r_GNRMgAAAMk"]
[Tue Mar 31 17:44:30.762969 2026] [:error] [pid 36892:tid 36965] [client 172.70.248.103:13007] [client 172.70.248.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local.backup"] [unique_id "acuXfkyj9S4G0ek3O4JqCwAAAI4"]
[Tue Mar 31 19:07:37.412601 2026] [:error] [pid 36982:tid 37007] [client 43.159.145.153:59352] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acuq-flMmeoQKN0r_GOEAwAAANY"]
[Tue Mar 31 23:52:50.270824 2026] [:error] [pid 2836:tid 2845] [client 170.106.72.93:39006] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acvt0ipQtaf_GRF3iPfw0AAAAgI"]
[Wed Apr 01 03:51:13.743868 2026] [:error] [pid 45776:tid 45794] [client 182.44.8.254:51292] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "acwlsW827UBx7K9U3bPXcAAAAMs"]
[Wed Apr 01 05:38:42.687755 2026] [:error] [pid 23714:tid 23756] [client 162.62.213.187:40318] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acw-4kHxDDU2ETcG9DSmJAAAABY"]
[Wed Apr 01 06:36:02.723897 2026] [:error] [pid 23819:tid 23839] [client 181.115.120.128:15727] [client 181.115.120.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.115.120.128, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "acxMUtdfUS_37wFAM77mZAAAANE"]
[Wed Apr 01 09:41:55.176460 2026] [:error] [pid 23714:tid 23749] [client 158.220.114.24:57701] [client 158.220.114.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.220.114.24, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "acx340HxDDU2ETcG9DRSmgAAAA8"]
[Wed Apr 01 11:08:44.655152 2026] [:error] [pid 24348:tid 24402] [client 43.166.246.180:59742] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "acyMPG0Vs69Y5nF1HA9AGgAAAZc"]
[Wed Apr 01 16:22:53.863428 2026] [:error] [pid 8995:tid 9021] [client 43.153.104.196:51482] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aczV3eonaBjs3qxcRedwAwAAABc"]
[Wed Apr 01 20:33:13.145964 2026] [:error] [pid 8908:tid 8937] [client 39.61.50.145:13434] [client 39.61.50.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.61.50.145, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ac0QifkmxtJXGnLdvgB65AAAAJg"]
[Wed Apr 01 21:18:26.762534 2026] [:error] [pid 62559:tid 62567] [client 216.24.210.119:46933] [client 216.24.210.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac0bIi7NKI8IaNKZFIekWwAAAUY"]
[Wed Apr 01 21:19:39.061291 2026] [:error] [pid 8910:tid 8983] [client 101.33.66.34:45440] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac0ba6JZINUcF3tYgExl7wAAAQ8"]
[Wed Apr 01 22:55:33.049535 2026] [:error] [pid 17856:tid 17869] [client 182.42.111.156:43952] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac0x5T7Idlm5j9frhqRyRAAAAEs"]
[Thu Apr 02 02:20:38.351494 2026] [:error] [pid 8037:tid 8132] [client 49.51.39.209:60580] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac1h9oGD8ox-W9jHVfDQigAAARg"]
[Thu Apr 02 05:05:30.343890 2026] [:error] [pid 59200:tid 59246] [client 182.42.104.32:50196] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ac2ImrfP26txrdLs3ErrmgAAAEY"]
[Thu Apr 02 08:16:19.246485 2026] [:error] [pid 54384:tid 54406] [client 43.166.130.123:47798] [client 43.166.130.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac21U9WWpaby3TVN7Mc9TgAAAdQ"]
[Thu Apr 02 10:59:58.952163 2026] [:error] [pid 23927:tid 23941] [client 49.51.180.2:49536] [client 49.51.180.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ac3brksZwqCndhl9uKDQLQAAAYw"]
[Thu Apr 02 11:50:49.334894 2026] [:error] [pid 54384:tid 54386] [client 217.216.37.56:52815] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac3nmdWWpaby3TVN7Md31gAAAcA"]
[Thu Apr 02 11:50:49.576048 2026] [:error] [pid 59201:tid 59270] [client 217.216.37.56:61948] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac3nmcAC0Tw8eL6gzZ6_dAAAAIM"]
[Thu Apr 02 11:50:49.805269 2026] [:error] [pid 59201:tid 59287] [client 217.216.37.56:60625] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "ac3nmcAC0Tw8eL6gzZ6_dQAAAJQ"]
[Thu Apr 02 12:08:15.677373 2026] [:error] [pid 54384:tid 54398] [client 123.231.16.195:41776] [client 123.231.16.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.231.16.195, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ac3rr9WWpaby3TVN7Md8JQAAAcw"]
[Thu Apr 02 16:14:19.684693 2026] [:error] [pid 23927:tid 23941] [client 43.131.253.14:56258] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ac4lW0sZwqCndhl9uKBVYAAAAYw"]
[Thu Apr 02 17:34:31.234060 2026] [:error] [pid 23927:tid 23938] [client 172.213.211.100:15572] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac44J0sZwqCndhl9uKBwegAAAYk"]
[Thu Apr 02 18:42:02.002101 2026] [:error] [pid 29467:tid 29482] [client 4.232.186.45:59247] [client 4.232.186.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ac5H-r4VUBFCJAq-WOk_3AAAAQw"]
[Thu Apr 02 18:51:21.599851 2026] [:error] [pid 59201:tid 59285] [client 43.153.135.208:35158] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac5KKcAC0Tw8eL6gzZ4KmwAAAJI"]
[Fri Apr 03 02:52:05.774374 2026] [:error] [pid 25018:tid 25423] [client 43.159.143.139:40284] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ac661XupR6lXnAUzFGogMgAAAEo"]
[Fri Apr 03 08:19:42.635031 2026] [ssl:error] [pid 40562:tid 40577] [client 47.128.112.27:59314] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Fri Apr 03 09:01:06.711532 2026] [:error] [pid 40562:tid 40576] [client 43.173.1.69:46128] [client 43.173.1.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ac8RUjfFMXuP9zvqCeqiKQAAAYs"]
[Fri Apr 03 12:02:37.778044 2026] [:error] [pid 35469:tid 35478] [client 49.51.195.195:40922] [client 49.51.195.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac873aGvTIc8-wY3jURrrQAAAQc"]
[Fri Apr 03 14:53:28.282153 2026] [:error] [pid 33446:tid 33485] [client 43.153.49.151:56014] [client 43.153.49.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ac9j6Ng3dCqFYIIdw0qrAQAAAEg"]
[Fri Apr 03 15:54:33.187751 2026] [:error] [pid 40562:tid 40583] [client 98.159.37.90:42089] [client 98.159.37.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac9yOTfFMXuP9zvqCeobeQAAAZI"]
[Fri Apr 03 17:43:13.218564 2026] [:error] [pid 33446:tid 33493] [client 43.155.26.193:51650] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ac-Lsdg3dCqFYIIdw0rjfQAAAFA"]
[Fri Apr 03 20:28:27.761679 2026] [:error] [pid 33446:tid 33478] [client 182.10.129.249:20233] [client 182.10.129.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.10.129.249, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ac-ya9g3dCqFYIIdw0pKSQAAAEE"]
[Sat Apr 04 00:43:31.147074 2026] [:error] [pid 12081:tid 12112] [client 20.151.202.75:65046] [client 20.151.202.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac_uM6MJBCYerZTQdmLdOAAAAEw"]
[Sat Apr 04 02:36:12.547206 2026] [:error] [pid 12097:tid 12173] [client 43.128.156.124:43228] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adAInBnkcvJ01y2CY3nTDwAAANI"]
[Sat Apr 04 08:22:44.528972 2026] [:error] [pid 2459:tid 2546] [client 182.44.2.148:51045] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adBZ1AefyCmu4LR_PlqnBwAAAI4"]
[Sat Apr 04 12:06:52.689775 2026] [:error] [pid 37114:tid 37137] [client 91.92.240.32:51859] [client 91.92.240.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "adCOXM-DnSj3fGMexeI5xgAAARU"]
[Sat Apr 04 12:22:29.735014 2026] [:error] [pid 2457:tid 2486] [client 43.166.240.231:54446] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adCSBUmNHppaMd92Zpe2vAAAAAk"]
[Sat Apr 04 13:21:16.675990 2026] [:error] [pid 37114:tid 37136] [client 185.198.240.115:51535] [client 185.198.240.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adCfzM-DnSj3fGMexeJpMAAAARQ"]
[Sat Apr 04 14:21:04.110356 2026] [:error] [pid 2457:tid 2492] [client 129.222.1.107:41954] [client 129.222.1.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.1.107, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adCt0EmNHppaMd92ZpfSYgAAAA8"]
[Sat Apr 04 14:53:32.819396 2026] [:error] [pid 2459:tid 2551] [client 182.42.105.85:45457] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adC1bAefyCmu4LR_Plo6pwAAAJM"]
[Sat Apr 04 21:10:44.759342 2026] [:error] [pid 2458:tid 2525] [client 43.130.139.136:43606] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adEN1CNozic5SuWqclklnQAAAFU"]
[Sat Apr 04 21:29:29.555101 2026] [:error] [pid 63487:tid 63509] [client 125.94.144.102:43697] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adESOWpqOMD5fJ8_5q32aAAAAVM"]
[Sat Apr 04 23:41:53.705178 2026] [:error] [pid 2457:tid 2499] [client 49.51.243.156:37136] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adExQUmNHppaMd92ZpeMaQAAABY"]
[Sun Apr 05 02:15:07.714978 2026] [:error] [pid 54081:tid 54160] [client 217.216.37.55:50928] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adFVK1JcnxTrqYU7_fpFDwAAANE"]
[Sun Apr 05 02:15:07.925877 2026] [:error] [pid 54081:tid 54150] [client 217.216.37.55:61988] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adFVK1JcnxTrqYU7_fpFEAAAAMc"]
[Sun Apr 05 02:15:08.137402 2026] [:error] [pid 54081:tid 54162] [client 217.216.37.55:51753] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "adFVLFJcnxTrqYU7_fpFEgAAANM"]
[Sun Apr 05 03:17:49.103129 2026] [:error] [pid 53821:tid 53941] [client 43.166.128.86:49036] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adFj3Yr_VtuiSAUdPhmsUgAAAI0"]
[Sun Apr 05 03:55:22.339020 2026] [:error] [pid 45409:tid 45425] [client 182.44.10.67:49820] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adFsqtHt_Oyw03gjCNhp-gAAAM4"]
[Sun Apr 05 07:04:17.139751 2026] [:error] [pid 45409:tid 45432] [client 43.166.255.122:34574] [client 43.166.255.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adGY8dHt_Oyw03gjCNj4kQAAANU"]
[Sun Apr 05 10:52:40.305971 2026] [:error] [pid 45304:tid 45347] [client 43.130.141.193:48326] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adHOeA5jnqDKKovdRklbmQAAAEM"]
[Sun Apr 05 10:52:55.482462 2026] [:error] [pid 45409:tid 45415] [client 74.248.146.253:50966] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adHOh9Ht_Oyw03gjCNh4AAAAAMQ"]
[Sun Apr 05 10:53:03.267803 2026] [:error] [pid 45303:tid 45339] [client 74.248.146.253:50965] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adHOj7boQ9eViZ4hdnno4wAAABY"]
[Sun Apr 05 19:56:37.208731 2026] [:error] [pid 30921:tid 30933] [client 49.51.132.100:50472] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adJN9WFGQVn8Q0ueB271fAAAAQo"]
[Sun Apr 05 23:31:25.488502 2026] [:error] [pid 45303:tid 45340] [client 223.15.245.170:52713] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adKATbboQ9eViZ4hdnmS6AAAABc"]
[Mon Apr 06 01:04:18.375168 2026] [:error] [pid 51580:tid 51658] [client 43.135.140.225:34858] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adKWElNFl1NiyNgNZAkb7gAAAFM"]
[Mon Apr 06 04:09:44.835178 2026] [:error] [pid 9442:tid 9461] [client 43.152.72.247:35254] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adLBiEPsNnAJTnmz6sZpewAAARE"]
[Mon Apr 06 05:49:06.360696 2026] [:error] [pid 9442:tid 9466] [client 36.111.67.189:59403] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adLY0kPsNnAJTnmz6sbJSgAAARY"]
[Mon Apr 06 06:54:24.099543 2026] [:error] [pid 35688:tid 35765] [client 43.130.40.120:42962] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adLoIOZ85qg4jLsRpQzBSAAAAI8"]
[Mon Apr 06 12:51:07.869742 2026] [:error] [pid 35686:tid 35719] [client 49.51.47.100:52402] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adM7u8MKdea6oORd2fzxpQAAABc"]
[Mon Apr 06 15:38:22.369672 2026] [:error] [pid 9413:tid 9439] [client 20.199.120.171:22069] [client 20.199.120.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNi7nllvEK3chn01wGPLQAAAZg"]
[Mon Apr 06 15:38:29.390649 2026] [:error] [pid 9442:tid 9462] [client 20.199.120.171:39846] [client 20.199.120.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNi9UPsNnAJTnmz6sZNiwAAARI"]
[Mon Apr 06 15:44:49.276268 2026] [:error] [pid 35688:tid 35769] [client 170.106.73.216:47278] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adNkceZ85qg4jLsRpQxCYgAAAJM"]
[Mon Apr 06 15:53:20.092401 2026] [:error] [pid 10280:tid 10306] [client 98.71.66.179:52884] [client 98.71.66.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNmcF8QUJkf8g-BFfN2zgAAAdc"]
[Mon Apr 06 15:53:20.416109 2026] [:error] [pid 38562:tid 38583] [client 98.71.66.179:6189] [client 98.71.66.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNmcKeD6Ohe6wzRuy4BrAAAAVI"]
[Mon Apr 06 15:56:36.488135 2026] [:error] [pid 35686:tid 35716] [client 158.158.72.15:59068] [client 158.158.72.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNnNMMKdea6oORd2fxA9wAAABQ"]
[Mon Apr 06 15:57:08.279465 2026] [:error] [pid 35686:tid 35702] [client 158.158.72.15:57258] [client 158.158.72.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNnVMMKdea6oORd2fxBtQAAAAY"]
[Mon Apr 06 15:57:08.495874 2026] [:error] [pid 38562:tid 38579] [client 158.158.72.15:57272] [client 158.158.72.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNnVKeD6Ohe6wzRuy4EcgAAAU4"]
[Mon Apr 06 16:01:10.021031 2026] [:error] [pid 9442:tid 9453] [client 20.91.136.114:48548] [client 20.91.136.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNoRkPsNnAJTnmz6sZUVQAAAQk"]
[Mon Apr 06 16:01:16.370853 2026] [:error] [pid 9413:tid 9428] [client 158.158.72.15:62848] [client 158.158.72.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNoTHllvEK3chn01wGVgQAAAY0"]
[Mon Apr 06 16:06:24.375381 2026] [:error] [pid 35687:tid 35732] [client 20.215.64.133:17181] [client 20.215.64.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNpgJ3LtDozV0i8BisnrgAAAEk"]
[Mon Apr 06 16:06:26.000698 2026] [:error] [pid 38562:tid 38575] [client 20.215.64.133:21136] [client 20.215.64.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNpgaeD6Ohe6wzRuy4LAwAAAUo"]
[Mon Apr 06 16:08:28.179877 2026] [:error] [pid 35688:tid 35756] [client 172.213.8.64:31888] [client 172.213.8.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNp_OZ85qg4jLsRpQxF7gAAAIY"]
[Mon Apr 06 16:08:51.801707 2026] [:error] [pid 38562:tid 38589] [client 98.71.66.179:16055] [client 98.71.66.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNqE6eD6Ohe6wzRuy4NvgAAAVg"]
[Mon Apr 06 16:09:51.833816 2026] [:error] [pid 38562:tid 38569] [client 20.215.64.133:51353] [client 20.215.64.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNqT6eD6Ohe6wzRuy4PHQAAAUQ"]
[Mon Apr 06 16:10:40.645482 2026] [:error] [pid 10280:tid 10297] [client 20.215.64.133:37431] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xdd.php"] [unique_id "adNqgF8QUJkf8g-BFfOAwgAAAc4"]
[Mon Apr 06 16:10:41.399568 2026] [:error] [pid 35687:tid 35735] [client 20.215.64.133:36541] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xdd.php"] [unique_id "adNqgZ3LtDozV0i8BispHAAAAEw"]
[Mon Apr 06 16:10:42.214016 2026] [:error] [pid 35687:tid 35746] [client 20.215.64.133:3712] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xdd.php"] [unique_id "adNqgp3LtDozV0i8BispIAAAAFc"]
[Mon Apr 06 16:10:43.759306 2026] [:error] [pid 9413:tid 9419] [client 20.215.64.133:3925] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xdd.php"] [unique_id "adNqg3llvEK3chn01wGXZQAAAYQ"]
[Mon Apr 06 16:10:45.731309 2026] [:error] [pid 38562:tid 38574] [client 20.215.64.133:3745] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ggb.php"] [unique_id "adNqhaeD6Ohe6wzRuy4QMwAAAUk"]
[Mon Apr 06 16:10:48.374935 2026] [:error] [pid 35687:tid 35726] [client 20.215.64.133:16099] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ggb.php"] [unique_id "adNqiJ3LtDozV0i8BispMwAAAEM"]
[Mon Apr 06 16:10:54.002285 2026] [:error] [pid 35686:tid 35714] [client 20.215.64.133:3755] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ggb.php"] [unique_id "adNqjsMKdea6oORd2fxQPAAAABI"]
[Mon Apr 06 16:10:57.871993 2026] [:error] [pid 35786:tid 35817] [client 20.215.64.133:16574] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ggb.php"] [unique_id "adNqkWgkfCKTaLhwaKT3mgAAANg"]
[Mon Apr 06 16:10:59.822211 2026] [:error] [pid 38562:tid 38575] [client 20.215.64.133:3667] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roksad1.php"] [unique_id "adNqk6eD6Ohe6wzRuy4QZwAAAUo"]
[Mon Apr 06 16:11:01.182941 2026] [:error] [pid 38562:tid 38586] [client 20.215.64.133:3141] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roksad1.php"] [unique_id "adNqlaeD6Ohe6wzRuy4QawAAAVU"]
[Mon Apr 06 16:11:02.123547 2026] [:error] [pid 38562:tid 38585] [client 20.215.64.133:14383] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roksad1.php"] [unique_id "adNqlqeD6Ohe6wzRuy4QcQAAAVQ"]
[Mon Apr 06 16:11:02.999036 2026] [:error] [pid 35688:tid 35772] [client 20.215.64.133:17807] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/roksad1.php"] [unique_id "adNqluZ85qg4jLsRpQxGkQAAAJY"]
[Mon Apr 06 16:11:03.826053 2026] [:error] [pid 35686:tid 35713] [client 20.215.64.133:17796] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update1.php"] [unique_id "adNql8MKdea6oORd2fxQdAAAABE"]
[Mon Apr 06 16:11:05.321068 2026] [:error] [pid 35687:tid 35724] [client 20.215.64.133:14360] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update1.php"] [unique_id "adNqmZ3LtDozV0i8BispXQAAAEE"]
[Mon Apr 06 16:11:06.458087 2026] [:error] [pid 38562:tid 38584] [client 20.215.64.133:37810] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update1.php"] [unique_id "adNqmqeD6Ohe6wzRuy4QggAAAVM"]
[Mon Apr 06 16:11:10.398936 2026] [:error] [pid 35687:tid 35723] [client 20.215.64.133:3674] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/update1.php"] [unique_id "adNqnp3LtDozV0i8BispbgAAAEA"]
[Mon Apr 06 16:11:16.207310 2026] [:error] [pid 10280:tid 10295] [client 20.215.64.133:25419] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "adNqpF8QUJkf8g-BFfOBEAAAAcw"]
[Mon Apr 06 16:11:19.343013 2026] [:error] [pid 35688:tid 35770] [client 20.215.64.133:19865] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "adNqp-Z85qg4jLsRpQxGqAAAAJQ"]
[Mon Apr 06 16:11:24.577506 2026] [:error] [pid 9442:tid 9446] [client 20.215.64.133:3978] [client 20.215.64.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-act.php"] [unique_id "adNqrEPsNnAJTnmz6sZWYwAAAQI"]
[Mon Apr 06 16:13:55.910350 2026] [:error] [pid 35687:tid 35740] [client 20.91.136.114:49359] [client 20.91.136.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adNrQ53LtDozV0i8BisqcgAAAFE"]
[Mon Apr 06 18:25:23.574104 2026] [:error] [pid 10280:tid 10295] [client 43.133.187.11:51878] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adOKE18QUJkf8g-BFfO_kQAAAcw"]
[Mon Apr 06 21:01:12.498365 2026] [:error] [pid 35688:tid 35774] [client 43.153.7.191:34852] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adOumOZ85qg4jLsRpQzIPwAAAJg"]
[Mon Apr 06 23:25:43.035918 2026] [:error] [pid 38562:tid 38574] [client 43.130.131.18:41018] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adPQd6eD6Ohe6wzRuy7BBQAAAUk"]
[Tue Apr 07 01:11:46.778690 2026] [:error] [pid 55003:tid 55022] [client 49.7.227.204:42132] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adPpUgiMyAbcUkWpJeDh2gAAAQ8"]
[Tue Apr 07 02:04:38.430561 2026] [:error] [pid 39748:tid 39765] [client 43.135.139.165:37274] [client 43.135.139.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adP1tigic31vPbqmSIrIngAAAMo"]
[Tue Apr 07 05:38:43.226003 2026] [:error] [pid 37596:tid 37628] [client 70.34.244.34:62523] [client 70.34.244.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "adQn46paAOZHEjRWjP3vNAAAABY"]
[Tue Apr 07 06:54:54.532890 2026] [:error] [pid 37598:tid 37674] [client 45.131.195.43:59561] [client 45.131.195.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adQ5vu9g7q_cV2WhPayaiQAAAI0"]
[Tue Apr 07 07:19:06.308399 2026] [:error] [pid 37719:tid 37731] [client 182.44.67.97:52730] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adQ_ak09Xv52u2xXGLBigQAAAMk"]
[Tue Apr 07 07:36:35.650921 2026] [:error] [pid 37596:tid 37621] [client 170.106.35.137:55778] [client 170.106.35.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adRDg6paAOZHEjRWjP0WQgAAAA8"]
[Tue Apr 07 10:28:57.705808 2026] [:error] [pid 37719:tid 37723] [client 43.135.144.81:33212] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adRr6U09Xv52u2xXGLDdKwAAAME"]
[Tue Apr 07 10:56:55.554450 2026] [:error] [pid 37596:tid 37613] [client 217.216.72.68:58342] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "adRyd6paAOZHEjRWjP1XCQAAAAc"]
[Tue Apr 07 10:56:59.618199 2026] [:error] [pid 37719:tid 37736] [client 217.216.72.68:63619] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/"] [unique_id "adRye009Xv52u2xXGLDvLwAAAM4"]
[Tue Apr 07 10:57:01.488190 2026] [:error] [pid 59490:tid 59501] [client 217.216.72.68:64148] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-admin/"] [unique_id "adRyfUcw8OFbiUZ7Rx0RxwAAAUk"]
[Tue Apr 07 10:57:10.743830 2026] [:error] [pid 37719:tid 37728] [client 217.216.72.68:60137] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "adRyhk09Xv52u2xXGLDvnAAAAMY"]
[Tue Apr 07 10:57:12.644409 2026] [:error] [pid 59551:tid 59568] [client 217.216.72.68:60167] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adRyiF7LN7Ubyqs-sVsf6wAAAY8"]
[Tue Apr 07 10:57:26.224374 2026] [:error] [pid 59551:tid 59575] [client 217.216.72.68:55179] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-admin/"] [unique_id "adRyll7LN7Ubyqs-sVsgIgAAAZY"]
[Tue Apr 07 10:57:26.826831 2026] [:error] [pid 37597:tid 37650] [client 217.216.72.68:50796] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/readme.html"] [unique_id "adRylg6uAY0QAy-8EELANwAAAFA"]
[Tue Apr 07 13:00:57.184397 2026] [:error] [pid 37719:tid 37742] [client 43.157.62.101:47044] [client 43.157.62.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adSPiU09Xv52u2xXGLAl9wAAANQ"]
[Tue Apr 07 13:36:38.496531 2026] [:error] [pid 59660:tid 59682] [client 1.15.52.154:39342] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adSX5jp3-oiX2o5bTszLgwAAAdQ"]
[Tue Apr 07 14:38:00.383747 2026] [:error] [pid 37597:tid 37643] [client 123.231.16.195:48792] [client 123.231.16.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.231.16.195, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adSmSA6uAY0QAy-8EEJiOQAAAEk"]
[Tue Apr 07 15:39:02.800980 2026] [:error] [pid 12948:tid 12953] [client 43.130.139.177:35848] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adS0lsbeSPAN8LvMqsZspwAAAQI"]
[Tue Apr 07 18:10:36.067504 2026] [:error] [pid 37597:tid 37656] [client 49.51.39.209:51568] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adTYHA6uAY0QAy-8EEIF_gAAAFY"]
[Tue Apr 07 18:17:54.701376 2026] [:error] [pid 37598:tid 37677] [client 4.165.129.60:53189] [client 4.165.129.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adTZ0u9g7q_cV2WhPaySDwAAAJA"]
[Tue Apr 07 20:10:38.023093 2026] [:error] [pid 12948:tid 12959] [client 125.75.66.97:38243] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adT0PsbeSPAN8LvMqsasEwAAAQg"]
[Tue Apr 07 22:20:22.317862 2026] [:error] [pid 37719:tid 37729] [client 72.146.25.221:6145] [client 72.146.25.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adUSpk09Xv52u2xXGLBOIQAAAMc"]
[Tue Apr 07 22:20:23.423916 2026] [:error] [pid 59551:tid 59555] [client 72.146.25.221:6178] [client 72.146.25.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adUSp17LN7Ubyqs-sVswzwAAAYI"]
[Tue Apr 07 22:20:24.874291 2026] [:error] [pid 37597:tid 37643] [client 72.146.25.221:6471] [client 72.146.25.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adUSqA6uAY0QAy-8EEK8pQAAAEk"]
[Tue Apr 07 22:20:26.245116 2026] [:error] [pid 37719:tid 37732] [client 72.146.25.221:48277] [client 72.146.25.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adUSqk09Xv52u2xXGLBOLQAAAMo"]
[Tue Apr 07 22:58:08.089553 2026] [:error] [pid 59551:tid 59557] [client 43.166.240.231:44884] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adUbgF7LN7Ubyqs-sVs7OAAAAYQ"]
[Wed Apr 08 01:27:33.560538 2026] [ssl:error] [pid 5246:tid 5270] [client 47.128.112.38:31068] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Wed Apr 08 02:45:31.734612 2026] [:error] [pid 5337:tid 5377] [client 123.187.240.242:41822] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adVQyyboIFdw6tlcN11ShwAAARM"]
[Wed Apr 08 07:05:29.499021 2026] [:error] [pid 16630:tid 16654] [client 43.133.91.48:50786] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adWNuSjfVAkPG-jgJErmoQAAARY"]
[Wed Apr 08 08:54:09.072404 2026] [:error] [pid 49984:tid 50011] [client 223.15.245.170:52271] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adWnMeYY_Bz5lRHcJIEtVgAAAVU"]
[Wed Apr 08 09:25:35.962248 2026] [:error] [pid 47625:tid 47648] [client 103.168.67.159:5038] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adWujyVuHyNWzZlE8PA27gAAAA4"]
[Wed Apr 08 09:25:36.698416 2026] [:error] [pid 47626:tid 47676] [client 103.168.67.159:5610] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adWukKjWI8TWtHx2sdZKRwAAAEg"]
[Wed Apr 08 09:25:37.402822 2026] [:error] [pid 47625:tid 47653] [client 103.168.67.159:6126] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adWukSVuHyNWzZlE8PA3CAAAABM"]
[Wed Apr 08 09:25:38.115161 2026] [:error] [pid 47627:tid 47707] [client 103.168.67.159:6632] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adWuknOljf1Quv_kDjn05QAAAIg"]
[Wed Apr 08 09:25:38.839979 2026] [:error] [pid 544:tid 561] [client 103.168.67.159:7086] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dashboard"] [unique_id "adWukjieLKSoiLVA6YfDKwAAAYw"]
[Wed Apr 08 09:25:39.542939 2026] [:error] [pid 47626:tid 47683] [client 103.168.67.159:7568] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dashboard"] [unique_id "adWuk6jWI8TWtHx2sdZKZgAAAE8"]
[Wed Apr 08 09:25:40.251415 2026] [:error] [pid 47627:tid 47709] [client 103.168.67.159:7992] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dashboard"] [unique_id "adWulHOljf1Quv_kDjn1CgAAAIo"]
[Wed Apr 08 09:25:40.963822 2026] [:error] [pid 49984:tid 49999] [client 103.168.67.159:8368] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dashboard"] [unique_id "adWulOYY_Bz5lRHcJIE-vgAAAUk"]
[Wed Apr 08 10:07:01.134794 2026] [:error] [pid 47627:tid 47721] [client 43.157.95.239:50286] [client 43.157.95.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adW4RXOljf1Quv_kDjkL-wAAAJY"]
[Wed Apr 08 10:26:05.533631 2026] [:error] [pid 16630:tid 16642] [client 122.161.48.83:3787] [client 122.161.48.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.48.83, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adW8vSjfVAkPG-jgJEprfQAAAQo"]
[Wed Apr 08 15:17:08.671087 2026] [:error] [pid 12490:tid 12507] [client 170.106.72.93:49302] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adYA9G1Fea4F4fbumr3-ZwAAAM8"]
[Wed Apr 08 18:35:23.881201 2026] [:error] [pid 12490:tid 12516] [client 52.156.212.3:36638] [client 52.156.212.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adYva21Fea4F4fbumr3jgwAAANg"]
[Wed Apr 08 21:31:48.016186 2026] [:error] [pid 35642:tid 35661] [client 192.144.148.122:57656] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adZYxA-CqryxdEs5DN9h1QAAAFE"]
[Wed Apr 08 22:05:17.802630 2026] [:error] [pid 64066:tid 64078] [client 45.248.76.214:60210] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adZgnVR3WucJgr2vZGZd7QAAAUk"]
[Wed Apr 08 22:05:17.878317 2026] [:error] [pid 7189:tid 7213] [client 45.248.76.214:60226] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adZgnRaBqhBSu0L37lrq4AAAAdY"]
[Wed Apr 08 22:05:17.995012 2026] [:error] [pid 7047:tid 7073] [client 45.248.76.214:60232] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "adZgneNh3oGO3pKiCzw6tgAAAZg"]
[Wed Apr 08 22:05:18.076256 2026] [:error] [pid 7047:tid 7052] [client 45.248.76.214:60246] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "adZgnuNh3oGO3pKiCzw6ugAAAYM"]
[Wed Apr 08 22:05:18.198429 2026] [:error] [pid 7047:tid 7069] [client 45.248.76.214:60250] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adZgnuNh3oGO3pKiCzw6wQAAAZQ"]
[Wed Apr 08 22:05:18.239343 2026] [:error] [pid 7189:tid 7212] [client 45.248.76.214:60264] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adZgnhaBqhBSu0L37lrq4wAAAdU"]
[Wed Apr 08 22:05:18.264441 2026] [:error] [pid 7189:tid 7195] [client 45.248.76.214:60280] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adZgnhaBqhBSu0L37lrq5AAAAcQ"]
[Wed Apr 08 22:05:18.293468 2026] [:error] [pid 12490:tid 12502] [client 45.248.76.214:60288] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adZgnm1Fea4F4fbumr0YfwAAAMo"]
[Wed Apr 08 22:05:18.318547 2026] [:error] [pid 12490:tid 12516] [client 45.248.76.214:60294] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adZgnm1Fea4F4fbumr0YgAAAANg"]
[Wed Apr 08 22:05:18.344199 2026] [:error] [pid 12490:tid 12512] [client 45.248.76.214:60308] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adZgnm1Fea4F4fbumr0YgQAAANQ"]
[Wed Apr 08 22:05:18.387252 2026] [:error] [pid 12453:tid 12466] [client 45.248.76.214:60320] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adZgnhjtW7S6XsLPvrRM9AAAAIs"]
[Wed Apr 08 22:05:18.444731 2026] [:error] [pid 7047:tid 7061] [client 45.248.76.214:60334] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "adZgnuNh3oGO3pKiCzw6xAAAAYw"]
[Wed Apr 08 22:05:18.504015 2026] [:error] [pid 12386:tid 12423] [client 45.248.76.214:60348] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adZgnhLhhLtqHi2gK7UjyQAAAQc"]
[Wed Apr 08 22:05:18.545695 2026] [:error] [pid 12453:tid 12464] [client 45.248.76.214:60360] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adZgnhjtW7S6XsLPvrRM9gAAAIk"]
[Wed Apr 08 22:05:18.588526 2026] [:error] [pid 7189:tid 7192] [client 45.248.76.214:60364] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adZgnhaBqhBSu0L37lrq5gAAAcE"]
[Wed Apr 08 22:05:18.714680 2026] [:error] [pid 7189:tid 7191] [client 45.248.76.214:60374] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adZgnhaBqhBSu0L37lrq7QAAAcA"]
[Wed Apr 08 22:05:18.756141 2026] [:error] [pid 12386:tid 12439] [client 45.248.76.214:60388] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adZgnhLhhLtqHi2gK7UjywAAARc"]
[Wed Apr 08 22:05:18.814581 2026] [:error] [pid 12386:tid 12422] [client 45.248.76.214:60390] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "adZgnhLhhLtqHi2gK7UjzgAAAQY"]
[Wed Apr 08 22:05:18.854999 2026] [:error] [pid 64066:tid 64087] [client 45.248.76.214:60406] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "adZgnlR3WucJgr2vZGZd8AAAAVI"]
[Wed Apr 08 22:05:18.948789 2026] [:error] [pid 64066:tid 64073] [client 45.248.76.214:60422] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adZgnlR3WucJgr2vZGZd9QAAAUQ"]
[Wed Apr 08 22:05:18.990998 2026] [:error] [pid 12490:tid 12511] [client 45.248.76.214:60428] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adZgnm1Fea4F4fbumr0YhAAAANM"]
[Wed Apr 08 22:05:19.039939 2026] [:error] [pid 12490:tid 12503] [client 45.248.76.214:60442] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "adZgn21Fea4F4fbumr0YhgAAAMs"]
[Wed Apr 08 22:05:19.073524 2026] [:error] [pid 12490:tid 12496] [client 45.248.76.214:60456] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adZgn21Fea4F4fbumr0YhwAAAMQ"]
[Wed Apr 08 22:05:19.099026 2026] [:error] [pid 12490:tid 12500] [client 45.248.76.214:60458] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "adZgn21Fea4F4fbumr0YiAAAAMg"]
[Wed Apr 08 22:05:19.203205 2026] [:error] [pid 12490:tid 12493] [client 45.248.76.214:60472] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/info.php"] [unique_id "adZgn21Fea4F4fbumr0YjAAAAME"]
[Wed Apr 08 22:05:19.229998 2026] [:error] [pid 12385:tid 12394] [client 45.248.76.214:60486] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class.api.php"] [unique_id "adZgnyAjtvRQEkLosq2oQAAAAAU"]
[Wed Apr 08 22:05:19.255651 2026] [:error] [pid 12490:tid 12515] [client 45.248.76.214:60502] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adZgn21Fea4F4fbumr0YjQAAANc"]
[Wed Apr 08 22:05:19.416980 2026] [:error] [pid 12490:tid 12514] [client 45.248.76.214:60518] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/admin.php"] [unique_id "adZgn21Fea4F4fbumr0YmAAAANY"]
[Wed Apr 08 22:05:19.490026 2026] [:error] [pid 64066:tid 64084] [client 45.248.76.214:60532] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adZgn1R3WucJgr2vZGZd-gAAAU8"]
[Wed Apr 08 22:05:19.678277 2026] [:error] [pid 64066:tid 64073] [client 45.248.76.214:60532] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adZgn1R3WucJgr2vZGZeBgAAAUQ"]
[Wed Apr 08 22:05:19.735826 2026] [:error] [pid 64066:tid 64088] [client 45.248.76.214:60536] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adZgn1R3WucJgr2vZGZeCgAAAVM"]
[Wed Apr 08 22:05:19.766950 2026] [:error] [pid 64066:tid 64078] [client 45.248.76.214:60536] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/item.php"] [unique_id "adZgn1R3WucJgr2vZGZeDAAAAUk"]
[Wed Apr 08 22:05:19.923848 2026] [:error] [pid 64066:tid 64086] [client 45.248.76.214:60544] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adZgn1R3WucJgr2vZGZeFgAAAVE"]
[Wed Apr 08 22:05:20.083564 2026] [:error] [pid 64066:tid 64082] [client 45.248.76.214:60560] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adZgoFR3WucJgr2vZGZeHwAAAU0"]
[Wed Apr 08 22:05:20.141723 2026] [:error] [pid 64066:tid 64093] [client 45.248.76.214:60570] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adZgoFR3WucJgr2vZGZeIgAAAVg"]
[Wed Apr 08 22:05:20.221129 2026] [:error] [pid 64066:tid 64088] [client 45.248.76.214:60576] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "adZgoFR3WucJgr2vZGZeJgAAAVM"]
[Wed Apr 08 22:05:20.237924 2026] [:error] [pid 64066:tid 64077] [client 45.248.76.214:60576] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adZgoFR3WucJgr2vZGZeJwAAAUg"]
[Wed Apr 08 22:05:20.552648 2026] [:error] [pid 12490:tid 12497] [client 45.248.76.214:60582] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adZgoG1Fea4F4fbumr0YrgAAAMU"]
[Wed Apr 08 22:05:20.624484 2026] [:error] [pid 12453:tid 12462] [client 45.248.76.214:60588] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adZgoBjtW7S6XsLPvrRM-gAAAIc"]
[Wed Apr 08 22:05:20.691112 2026] [:error] [pid 12453:tid 12474] [client 45.248.76.214:60588] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about.php"] [unique_id "adZgoBjtW7S6XsLPvrRM_gAAAJM"]
[Wed Apr 08 22:05:20.733184 2026] [:error] [pid 12385:tid 12401] [client 45.248.76.214:60592] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/infi.php"] [unique_id "adZgoCAjtvRQEkLosq2oQgAAAAw"]
[Wed Apr 08 22:05:20.790753 2026] [:error] [pid 12490:tid 12505] [client 45.248.76.214:60608] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "adZgoG1Fea4F4fbumr0YsQAAAM0"]
[Wed Apr 08 22:05:20.864297 2026] [:error] [pid 12490:tid 12503] [client 45.248.76.214:60618] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "adZgoG1Fea4F4fbumr0YtQAAAMs"]
[Wed Apr 08 22:05:20.892453 2026] [:error] [pid 12490:tid 12509] [client 45.248.76.214:60634] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "adZgoG1Fea4F4fbumr0YtgAAANE"]
[Wed Apr 08 22:05:22.609439 2026] [:error] [pid 7047:tid 7052] [client 45.248.76.214:60638] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adZgouNh3oGO3pKiCzw6zAAAAYM"]
[Wed Apr 08 22:05:22.661033 2026] [:error] [pid 12453:tid 12479] [client 45.248.76.214:60650] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "adZgohjtW7S6XsLPvrRNAAAAAJg"]
[Wed Apr 08 22:05:22.734419 2026] [:error] [pid 64066:tid 64086] [client 45.248.76.214:60664] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit.php"] [unique_id "adZgolR3WucJgr2vZGZeLgAAAVE"]
[Wed Apr 08 22:05:22.810641 2026] [:error] [pid 12490:tid 12507] [client 45.248.76.214:60674] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adZgom1Fea4F4fbumr0YxAAAAM8"]
[Wed Apr 08 22:05:22.868094 2026] [:error] [pid 12453:tid 12465] [client 45.248.76.214:60678] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/click.php"] [unique_id "adZgohjtW7S6XsLPvrRNBAAAAIo"]
[Wed Apr 08 22:05:22.942462 2026] [:error] [pid 64066:tid 64077] [client 45.248.76.214:60692] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adZgolR3WucJgr2vZGZeNAAAAUg"]
[Wed Apr 08 22:05:23.081338 2026] [:error] [pid 12490:tid 12510] [client 45.248.76.214:60696] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adZgo21Fea4F4fbumr0YzQAAANI"]
[Wed Apr 08 22:05:23.107643 2026] [:error] [pid 12490:tid 12496] [client 45.248.76.214:60704] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/xl2023.php"] [unique_id "adZgo21Fea4F4fbumr0YzgAAAMQ"]
[Wed Apr 08 22:05:23.133090 2026] [:error] [pid 12490:tid 12515] [client 45.248.76.214:60708] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adZgo21Fea4F4fbumr0YzwAAANc"]
[Wed Apr 08 22:05:23.159889 2026] [:error] [pid 12490:tid 12499] [client 45.248.76.214:60724] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adZgo21Fea4F4fbumr0Y0AAAAMc"]
[Wed Apr 08 22:05:23.202308 2026] [:error] [pid 12386:tid 12424] [client 45.248.76.214:60736] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adZgoxLhhLtqHi2gK7Uj1AAAAQg"]
[Wed Apr 08 22:05:23.227719 2026] [:error] [pid 64066:tid 64090] [client 45.248.76.214:60738] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "adZgo1R3WucJgr2vZGZeNgAAAVU"]
[Wed Apr 08 22:05:23.291047 2026] [:error] [pid 7047:tid 7064] [client 45.248.76.214:60754] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "adZgo-Nh3oGO3pKiCzw6zwAAAY8"]
[Wed Apr 08 22:05:23.317580 2026] [:error] [pid 64066:tid 64082] [client 45.248.76.214:60760] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "adZgo1R3WucJgr2vZGZeNwAAAU0"]
[Wed Apr 08 22:05:23.344634 2026] [:error] [pid 64066:tid 64081] [client 45.248.76.214:60770] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adZgo1R3WucJgr2vZGZeOAAAAUw"]
[Wed Apr 08 22:05:23.370687 2026] [:error] [pid 64066:tid 64073] [client 45.248.76.214:60784] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "adZgo1R3WucJgr2vZGZeOQAAAUQ"]
[Wed Apr 08 22:05:23.413677 2026] [:error] [pid 64066:tid 64070] [client 45.248.76.214:60790] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adZgo1R3WucJgr2vZGZeOwAAAUE"]
[Wed Apr 08 22:05:23.473604 2026] [:error] [pid 7047:tid 7067] [client 45.248.76.214:60802] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "adZgo-Nh3oGO3pKiCzw60gAAAZI"]
[Wed Apr 08 22:05:25.048157 2026] [:error] [pid 12386:tid 12433] [client 45.248.76.214:60816] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adZgpRLhhLtqHi2gK7Uj2QAAARE"]
[Wed Apr 08 22:05:25.195065 2026] [:error] [pid 64066:tid 64081] [client 45.248.76.214:55828] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/file.php"] [unique_id "adZgpVR3WucJgr2vZGZeSAAAAUw"]
[Wed Apr 08 22:05:25.267984 2026] [:error] [pid 64066:tid 64093] [client 45.248.76.214:55838] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adZgpVR3WucJgr2vZGZeTAAAAVg"]
[Wed Apr 08 22:05:25.294669 2026] [:error] [pid 64066:tid 64071] [client 45.248.76.214:55848] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adZgpVR3WucJgr2vZGZeTQAAAUI"]
[Wed Apr 08 22:05:25.384059 2026] [:error] [pid 64066:tid 64090] [client 45.248.76.214:55854] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adZgpVR3WucJgr2vZGZeUgAAAVU"]
[Wed Apr 08 22:05:25.468869 2026] [proxy_fcgi:error] [pid 64066:tid 64081] [client 45.248.76.214:55858] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:25.486281 2026] [proxy_fcgi:error] [pid 64066:tid 64075] [client 45.248.76.214:55858] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:25.501895 2026] [proxy_fcgi:error] [pid 64066:tid 64086] [client 45.248.76.214:55858] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:25.582337 2026] [:error] [pid 64066:tid 64071] [client 45.248.76.214:55858] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "adZgpVR3WucJgr2vZGZeXgAAAUI"]
[Wed Apr 08 22:05:25.607801 2026] [:error] [pid 64066:tid 64087] [client 45.248.76.214:55874] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adZgpVR3WucJgr2vZGZeXwAAAVI"]
[Wed Apr 08 22:05:25.633464 2026] [:error] [pid 7189:tid 7214] [client 45.248.76.214:55886] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adZgpRaBqhBSu0L37lrq8AAAAdc"]
[Wed Apr 08 22:05:25.659038 2026] [:error] [pid 7189:tid 7195] [client 45.248.76.214:55900] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adZgpRaBqhBSu0L37lrq8QAAAcQ"]
[Wed Apr 08 22:05:25.684474 2026] [:error] [pid 7047:tid 7053] [client 45.248.76.214:55902] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adZgpeNh3oGO3pKiCzw61QAAAYQ"]
[Wed Apr 08 22:05:25.709969 2026] [:error] [pid 7047:tid 7051] [client 45.248.76.214:55910] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adZgpeNh3oGO3pKiCzw61gAAAYI"]
[Wed Apr 08 22:05:25.751603 2026] [:error] [pid 7047:tid 7071] [client 45.248.76.214:55924] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "adZgpeNh3oGO3pKiCzw62AAAAZY"]
[Wed Apr 08 22:05:25.776848 2026] [:error] [pid 7047:tid 7058] [client 45.248.76.214:55926] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adZgpeNh3oGO3pKiCzw62QAAAYk"]
[Wed Apr 08 22:05:25.801847 2026] [:error] [pid 12453:tid 12462] [client 45.248.76.214:55942] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adZgpRjtW7S6XsLPvrRNBwAAAIc"]
[Wed Apr 08 22:05:25.827363 2026] [:error] [pid 12453:tid 12467] [client 45.248.76.214:55952] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adZgpRjtW7S6XsLPvrRNCAAAAIw"]
[Wed Apr 08 22:05:25.886365 2026] [:error] [pid 12453:tid 12455] [client 45.248.76.214:55956] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adZgpRjtW7S6XsLPvrRNCwAAAIA"]
[Wed Apr 08 22:05:25.927625 2026] [:error] [pid 12453:tid 12470] [client 45.248.76.214:55970] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "adZgpRjtW7S6XsLPvrRNDQAAAI8"]
[Wed Apr 08 22:05:25.985176 2026] [:error] [pid 12453:tid 12464] [client 45.248.76.214:55974] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adZgpRjtW7S6XsLPvrRNEAAAAIk"]
[Wed Apr 08 22:05:26.041945 2026] [:error] [pid 12490:tid 12510] [client 45.248.76.214:55984] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/about.php"] [unique_id "adZgpm1Fea4F4fbumr0Y1QAAANI"]
[Wed Apr 08 22:05:26.114252 2026] [:error] [pid 64066:tid 64082] [client 45.248.76.214:55998] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adZgplR3WucJgr2vZGZeZAAAAU0"]
[Wed Apr 08 22:05:26.202949 2026] [:error] [pid 12386:tid 12420] [client 45.248.76.214:56000] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "adZgphLhhLtqHi2gK7Uj3gAAAQQ"]
[Wed Apr 08 22:05:26.246868 2026] [:error] [pid 12386:tid 12418] [client 45.248.76.214:56004] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "adZgphLhhLtqHi2gK7Uj4AAAAQI"]
[Wed Apr 08 22:05:26.536614 2026] [:error] [pid 12385:tid 12394] [client 45.248.76.214:56010] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adZgpiAjtvRQEkLosq2oUwAAAAU"]
[Wed Apr 08 22:05:26.562391 2026] [:error] [pid 12490:tid 12496] [client 45.248.76.214:56022] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adZgpm1Fea4F4fbumr0Y1gAAAMQ"]
[Wed Apr 08 22:05:26.603782 2026] [:error] [pid 7047:tid 7073] [client 45.248.76.214:56030] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adZgpuNh3oGO3pKiCzw62wAAAZg"]
[Wed Apr 08 22:05:26.661323 2026] [:error] [pid 12490:tid 12511] [client 45.248.76.214:56034] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adZgpm1Fea4F4fbumr0Y2QAAANM"]
[Wed Apr 08 22:05:26.729422 2026] [:error] [pid 12386:tid 12431] [client 45.248.76.214:56038] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adZgphLhhLtqHi2gK7Uj4QAAAQ8"]
[Wed Apr 08 22:05:26.821083 2026] [:error] [pid 7189:tid 7196] [client 45.248.76.214:56042] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adZgphaBqhBSu0L37lrq9gAAAcU"]
[Wed Apr 08 22:05:26.846278 2026] [:error] [pid 35642:tid 35655] [client 45.248.76.214:56058] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "adZgpg-CqryxdEs5DN9nxwAAAEs"]
[Wed Apr 08 22:05:28.534552 2026] [:error] [pid 7189:tid 7201] [client 45.248.76.214:56064] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adZgqBaBqhBSu0L37lrq_gAAAco"]
[Wed Apr 08 22:05:28.581362 2026] [proxy_fcgi:error] [pid 12385:tid 12400] [client 45.248.76.214:56066] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:28.611705 2026] [:error] [pid 12385:tid 12395] [client 45.248.76.214:56066] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/function.php"] [unique_id "adZgqCAjtvRQEkLosq2oWgAAAAY"]
[Wed Apr 08 22:05:28.636470 2026] [:error] [pid 64066:tid 64085] [client 45.248.76.214:56070] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugins.php"] [unique_id "adZgqFR3WucJgr2vZGZeZgAAAVA"]
[Wed Apr 08 22:05:28.693731 2026] [:error] [pid 12453:tid 12475] [client 45.248.76.214:56078] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "adZgqBjtW7S6XsLPvrRNEwAAAJQ"]
[Wed Apr 08 22:05:28.718761 2026] [:error] [pid 12453:tid 12476] [client 45.248.76.214:56082] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adZgqBjtW7S6XsLPvrRNFAAAAJU"]
[Wed Apr 08 22:05:28.851532 2026] [:error] [pid 7047:tid 7051] [client 45.248.76.214:56090] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/atomlib.php"] [unique_id "adZgqONh3oGO3pKiCzw65AAAAYI"]
[Wed Apr 08 22:05:28.876017 2026] [:error] [pid 12453:tid 12478] [client 45.248.76.214:56102] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adZgqBjtW7S6XsLPvrRNFQAAAJc"]
[Wed Apr 08 22:05:28.964516 2026] [:error] [pid 12453:tid 12458] [client 45.248.76.214:56110] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "adZgqBjtW7S6XsLPvrRNGgAAAIM"]
[Wed Apr 08 22:05:28.989720 2026] [:error] [pid 7189:tid 7208] [client 45.248.76.214:56124] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adZgqBaBqhBSu0L37lrq_wAAAdE"]
[Wed Apr 08 22:05:29.014460 2026] [:error] [pid 7189:tid 7193] [client 45.248.76.214:56140] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adZgqRaBqhBSu0L37lrrAAAAAcI"]
[Wed Apr 08 22:05:29.125658 2026] [:error] [pid 35642:tid 35661] [client 45.248.76.214:56154] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adZgqQ-CqryxdEs5DN9nzgAAAFE"]
[Wed Apr 08 22:05:29.166654 2026] [:error] [pid 12453:tid 12469] [client 45.248.76.214:56170] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adZgqRjtW7S6XsLPvrRNHAAAAI4"]
[Wed Apr 08 22:05:29.316255 2026] [:error] [pid 35642:tid 35648] [client 45.248.76.214:56180] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/js/wp-login.php"] [unique_id "adZgqQ-CqryxdEs5DN9n1gAAAEQ"]
[Wed Apr 08 22:05:29.423444 2026] [:error] [pid 35642:tid 35654] [client 45.248.76.214:56180] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adZgqQ-CqryxdEs5DN9n3AAAAEo"]
[Wed Apr 08 22:05:29.609623 2026] [proxy_fcgi:error] [pid 35642:tid 35647] [client 45.248.76.214:56180] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:29.849764 2026] [:error] [pid 35642:tid 35656] [client 45.248.76.214:56180] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "adZgqQ-CqryxdEs5DN9n9gAAAEw"]
[Wed Apr 08 22:05:29.923989 2026] [:error] [pid 35642:tid 35653] [client 45.248.76.214:56192] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adZgqQ-CqryxdEs5DN9n-gAAAEk"]
[Wed Apr 08 22:05:29.982336 2026] [:error] [pid 12490:tid 12510] [client 45.248.76.214:56198] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adZgqW1Fea4F4fbumr0Y3AAAANI"]
[Wed Apr 08 22:05:30.158454 2026] [:error] [pid 12490:tid 12516] [client 45.248.76.214:56212] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adZgqm1Fea4F4fbumr0Y5gAAANg"]
[Wed Apr 08 22:05:30.215376 2026] [:error] [pid 7189:tid 7194] [client 45.248.76.214:56214] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adZgqhaBqhBSu0L37lrrBAAAAcM"]
[Wed Apr 08 22:05:30.256756 2026] [:error] [pid 7189:tid 7211] [client 45.248.76.214:56222] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adZgqhaBqhBSu0L37lrrBgAAAdQ"]
[Wed Apr 08 22:05:30.347206 2026] [proxy_fcgi:error] [pid 12490:tid 12504] [client 45.248.76.214:56236] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:30.363827 2026] [proxy_fcgi:error] [pid 12490:tid 12500] [client 45.248.76.214:56236] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:30.377431 2026] [:error] [pid 12490:tid 12513] [client 45.248.76.214:56236] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adZgqm1Fea4F4fbumr0Y7QAAANU"]
[Wed Apr 08 22:05:30.402346 2026] [:error] [pid 12490:tid 12510] [client 45.248.76.214:56252] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adZgqm1Fea4F4fbumr0Y7gAAANI"]
[Wed Apr 08 22:05:30.539768 2026] [:error] [pid 7047:tid 7068] [client 45.248.76.214:56262] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adZgquNh3oGO3pKiCzw67QAAAZM"]
[Wed Apr 08 22:05:30.581111 2026] [:error] [pid 7047:tid 7063] [client 45.248.76.214:56272] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "adZgquNh3oGO3pKiCzw67wAAAY4"]
[Wed Apr 08 22:05:30.652594 2026] [:error] [pid 64066:tid 64074] [client 45.248.76.214:56280] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adZgqlR3WucJgr2vZGZeagAAAUU"]
[Wed Apr 08 22:05:30.784452 2026] [:error] [pid 64066:tid 64079] [client 45.248.76.214:56294] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adZgqlR3WucJgr2vZGZecgAAAUo"]
[Wed Apr 08 22:05:30.813012 2026] [proxy_fcgi:error] [pid 7189:tid 7203] [client 45.248.76.214:56300] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:30.855691 2026] [:error] [pid 7189:tid 7201] [client 45.248.76.214:56300] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adZgqhaBqhBSu0L37lrrCgAAAco"]
[Wed Apr 08 22:05:30.958737 2026] [proxy_fcgi:error] [pid 7047:tid 7066] [client 45.248.76.214:56308] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:30.986990 2026] [:error] [pid 7047:tid 7065] [client 45.248.76.214:56308] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adZgquNh3oGO3pKiCzw69wAAAZA"]
[Wed Apr 08 22:05:31.065341 2026] [:error] [pid 7047:tid 7072] [client 45.248.76.214:56308] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adZgq-Nh3oGO3pKiCzw6_AAAAZc"]
[Wed Apr 08 22:05:31.108088 2026] [:error] [pid 12490:tid 12493] [client 45.248.76.214:56320] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adZgq21Fea4F4fbumr0Y8QAAAME"]
[Wed Apr 08 22:05:31.199515 2026] [:error] [pid 64066:tid 64089] [client 45.248.76.214:56334] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adZgq1R3WucJgr2vZGZeeAAAAVQ"]
[Wed Apr 08 22:05:31.275166 2026] [:error] [pid 7189:tid 7195] [client 45.248.76.214:56346] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adZgqxaBqhBSu0L37lrrDgAAAcQ"]
[Wed Apr 08 22:05:31.301003 2026] [:error] [pid 12453:tid 12475] [client 45.248.76.214:56348] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adZgqxjtW7S6XsLPvrRNHgAAAJQ"]
[Wed Apr 08 22:05:31.374929 2026] [:error] [pid 12453:tid 12456] [client 45.248.76.214:56352] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adZgqxjtW7S6XsLPvrRNIgAAAIE"]
[Wed Apr 08 22:05:31.436965 2026] [proxy_fcgi:error] [pid 12490:tid 12499] [client 45.248.76.214:56364] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:31.450925 2026] [:error] [pid 12490:tid 12507] [client 45.248.76.214:56364] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adZgq21Fea4F4fbumr0Y9QAAAM8"]
[Wed Apr 08 22:05:31.493467 2026] [:error] [pid 64066:tid 64086] [client 45.248.76.214:56368] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/db.php"] [unique_id "adZgq1R3WucJgr2vZGZeegAAAVE"]
[Wed Apr 08 22:05:31.519179 2026] [:error] [pid 64066:tid 64069] [client 45.248.76.214:56384] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adZgq1R3WucJgr2vZGZefAAAAUA"]
[Wed Apr 08 22:05:31.544569 2026] [:error] [pid 64066:tid 64085] [client 45.248.76.214:56386] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adZgq1R3WucJgr2vZGZefQAAAVA"]
[Wed Apr 08 22:05:31.570572 2026] [:error] [pid 12386:tid 12419] [client 45.248.76.214:56388] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adZgqxLhhLtqHi2gK7Uj5QAAAQM"]
[Wed Apr 08 22:05:31.595504 2026] [:error] [pid 12453:tid 12478] [client 45.248.76.214:56390] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adZgqxjtW7S6XsLPvrRNIwAAAJc"]
[Wed Apr 08 22:05:31.620918 2026] [:error] [pid 12453:tid 12472] [client 45.248.76.214:56404] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adZgqxjtW7S6XsLPvrRNJAAAAJE"]
[Wed Apr 08 22:05:31.679503 2026] [:error] [pid 12453:tid 12465] [client 45.248.76.214:56410] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adZgqxjtW7S6XsLPvrRNJwAAAIo"]
[Wed Apr 08 22:05:31.705787 2026] [:error] [pid 12385:tid 12397] [client 45.248.76.214:56422] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adZgqyAjtvRQEkLosq2oWwAAAAg"]
[Wed Apr 08 22:05:31.731176 2026] [:error] [pid 12386:tid 12416] [client 45.248.76.214:56428] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adZgqxLhhLtqHi2gK7Uj5gAAAQA"]
[Wed Apr 08 22:05:31.756495 2026] [:error] [pid 12386:tid 12439] [client 45.248.76.214:56438] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adZgqxLhhLtqHi2gK7Uj5wAAARc"]
[Wed Apr 08 22:05:31.781114 2026] [:error] [pid 64066:tid 64090] [client 45.248.76.214:56444] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/options.php"] [unique_id "adZgq1R3WucJgr2vZGZefwAAAVU"]
[Wed Apr 08 22:05:31.809823 2026] [proxy_fcgi:error] [pid 12386:tid 12429] [client 45.248.76.214:56454] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:31.852749 2026] [:error] [pid 12386:tid 12418] [client 45.248.76.214:56454] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adZgqxLhhLtqHi2gK7Uj6wAAAQI"]
[Wed Apr 08 22:05:31.934937 2026] [:error] [pid 12386:tid 12427] [client 45.248.76.214:56454] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adZgqxLhhLtqHi2gK7Uj8AAAAQs"]
[Wed Apr 08 22:05:33.807531 2026] [:error] [pid 12453:tid 12470] [client 45.248.76.214:56458] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adZgrRjtW7S6XsLPvrRNOQAAAI8"]
[Wed Apr 08 22:05:33.834141 2026] [:error] [pid 12385:tid 12406] [client 45.248.76.214:56468] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adZgrSAjtvRQEkLosq2oXQAAABE"]
[Wed Apr 08 22:05:33.860135 2026] [:error] [pid 64066:tid 64074] [client 45.248.76.214:56478] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adZgrVR3WucJgr2vZGZegQAAAUU"]
[Wed Apr 08 22:05:35.425158 2026] [:error] [pid 12386:tid 12436] [client 45.248.76.214:56492] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adZgrxLhhLtqHi2gK7Uj-gAAARQ"]
[Wed Apr 08 22:05:35.451345 2026] [:error] [pid 12453:tid 12464] [client 45.248.76.214:14134] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adZgrxjtW7S6XsLPvrRNOgAAAIk"]
[Wed Apr 08 22:05:35.477346 2026] [:error] [pid 12385:tid 12392] [client 45.248.76.214:14148] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adZgryAjtvRQEkLosq2oXwAAAAM"]
[Wed Apr 08 22:05:35.567402 2026] [:error] [pid 64066:tid 64072] [client 45.248.76.214:14156] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adZgr1R3WucJgr2vZGZeiAAAAUM"]
[Wed Apr 08 22:05:35.608970 2026] [:error] [pid 12490:tid 12509] [client 45.248.76.214:14166] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adZgr21Fea4F4fbumr0Y-gAAANE"]
[Wed Apr 08 22:05:35.666923 2026] [:error] [pid 7047:tid 7060] [client 45.248.76.214:14176] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adZgr-Nh3oGO3pKiCzw7AQAAAYs"]
[Wed Apr 08 22:05:35.876022 2026] [:error] [pid 7047:tid 7058] [client 45.248.76.214:14190] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "adZgr-Nh3oGO3pKiCzw7DgAAAYk"]
[Wed Apr 08 22:05:35.917423 2026] [:error] [pid 64066:tid 64078] [client 45.248.76.214:14202] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "adZgr1R3WucJgr2vZGZeiwAAAUk"]
[Wed Apr 08 22:05:36.041883 2026] [:error] [pid 64066:tid 64092] [client 45.248.76.214:14212] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "adZgsFR3WucJgr2vZGZekgAAAVc"]
[Wed Apr 08 22:05:36.101659 2026] [:error] [pid 64066:tid 64069] [client 45.248.76.214:14218] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adZgsFR3WucJgr2vZGZelQAAAUA"]
[Wed Apr 08 22:05:36.198933 2026] [:error] [pid 64066:tid 64087] [client 45.248.76.214:14226] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adZgsFR3WucJgr2vZGZemgAAAVI"]
[Wed Apr 08 22:05:36.289634 2026] [:error] [pid 64066:tid 64089] [client 45.248.76.214:14228] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adZgsFR3WucJgr2vZGZenwAAAVQ"]
[Wed Apr 08 22:05:36.347371 2026] [:error] [pid 64066:tid 64084] [client 45.248.76.214:14232] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adZgsFR3WucJgr2vZGZeogAAAU8"]
[Wed Apr 08 22:05:36.372818 2026] [:error] [pid 64066:tid 64073] [client 45.248.76.214:14234] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adZgsFR3WucJgr2vZGZeowAAAUQ"]
[Wed Apr 08 22:05:36.482601 2026] [:error] [pid 64066:tid 64076] [client 45.248.76.214:14238] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adZgsFR3WucJgr2vZGZeqQAAAUc"]
[Wed Apr 08 22:05:36.595144 2026] [:error] [pid 7047:tid 7063] [client 45.248.76.214:14244] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adZgsONh3oGO3pKiCzw7FQAAAY4"]
[Wed Apr 08 22:05:36.687678 2026] [:error] [pid 7047:tid 7066] [client 45.248.76.214:14254] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adZgsONh3oGO3pKiCzw7GgAAAZE"]
[Wed Apr 08 22:05:36.713209 2026] [:error] [pid 12386:tid 12418] [client 45.248.76.214:14266] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adZgsBLhhLtqHi2gK7Uj-wAAAQI"]
[Wed Apr 08 22:05:36.753887 2026] [:error] [pid 12453:tid 12461] [client 45.248.76.214:14274] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adZgsBjtW7S6XsLPvrRNPQAAAIY"]
[Wed Apr 08 22:05:36.812224 2026] [:error] [pid 12386:tid 12427] [client 45.248.76.214:14284] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/install.php"] [unique_id "adZgsBLhhLtqHi2gK7Uj_gAAAQs"]
[Wed Apr 08 22:05:36.836975 2026] [:error] [pid 12453:tid 12467] [client 45.248.76.214:14294] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adZgsBjtW7S6XsLPvrRNPwAAAIw"]
[Wed Apr 08 22:05:36.959757 2026] [:error] [pid 64066:tid 64081] [client 45.248.76.214:14298] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/category-double.php"] [unique_id "adZgsFR3WucJgr2vZGZesQAAAUw"]
[Wed Apr 08 22:05:37.018046 2026] [:error] [pid 12385:tid 12395] [client 45.248.76.214:14300] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/db.php"] [unique_id "adZgsSAjtvRQEkLosq2oYwAAAAY"]
[Wed Apr 08 22:05:37.043326 2026] [:error] [pid 64066:tid 64086] [client 45.248.76.214:14302] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "adZgsVR3WucJgr2vZGZeswAAAVE"]
[Wed Apr 08 22:05:37.105746 2026] [:error] [pid 64066:tid 64071] [client 45.248.76.214:14306] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adZgsVR3WucJgr2vZGZetgAAAUI"]
[Wed Apr 08 22:05:37.147459 2026] [:error] [pid 7047:tid 7069] [client 45.248.76.214:14316] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adZgseNh3oGO3pKiCzw7HAAAAZQ"]
[Wed Apr 08 22:05:37.255928 2026] [:error] [pid 64066:tid 64090] [client 45.248.76.214:14320] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adZgsVR3WucJgr2vZGZevAAAAVU"]
[Wed Apr 08 22:05:37.316123 2026] [:error] [pid 64066:tid 64074] [client 45.248.76.214:14326] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adZgsVR3WucJgr2vZGZevwAAAUU"]
[Wed Apr 08 22:05:37.374517 2026] [:error] [pid 12385:tid 12397] [client 45.248.76.214:14336] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adZgsSAjtvRQEkLosq2oZgAAAAg"]
[Wed Apr 08 22:05:37.418209 2026] [:error] [pid 64066:tid 64086] [client 45.248.76.214:14342] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/as.php"] [unique_id "adZgsVR3WucJgr2vZGZewQAAAVE"]
[Wed Apr 08 22:05:37.458293 2026] [:error] [pid 64066:tid 64072] [client 45.248.76.214:14352] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adZgsVR3WucJgr2vZGZewwAAAUM"]
[Wed Apr 08 22:05:37.483144 2026] [:error] [pid 7047:tid 7072] [client 45.248.76.214:14362] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/install.php"] [unique_id "adZgseNh3oGO3pKiCzw7HQAAAZc"]
[Wed Apr 08 22:05:37.508320 2026] [:error] [pid 35642:tid 35649] [client 45.248.76.214:14366] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/db.php"] [unique_id "adZgsQ-CqryxdEs5DN9n_AAAAEU"]
[Wed Apr 08 22:05:39.088952 2026] [:error] [pid 12453:tid 12468] [client 45.248.76.214:14374] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adZgsxjtW7S6XsLPvrRNRwAAAI0"]
[Wed Apr 08 22:05:39.160469 2026] [:error] [pid 64066:tid 64090] [client 45.248.76.214:14384] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rk2.php"] [unique_id "adZgs1R3WucJgr2vZGZeyQAAAVU"]
[Wed Apr 08 22:05:39.220965 2026] [:error] [pid 64066:tid 64074] [client 45.248.76.214:14388] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "adZgs1R3WucJgr2vZGZezAAAAUU"]
[Wed Apr 08 22:05:39.281411 2026] [:error] [pid 64066:tid 64073] [client 45.248.76.214:14404] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "adZgs1R3WucJgr2vZGZezwAAAUQ"]
[Wed Apr 08 22:05:39.383789 2026] [:error] [pid 12386:tid 12437] [client 45.248.76.214:14412] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adZgsxLhhLtqHi2gK7UkBAAAARU"]
[Wed Apr 08 22:05:39.424738 2026] [:error] [pid 12385:tid 12398] [client 45.248.76.214:14420] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adZgsyAjtvRQEkLosq2oaAAAAAk"]
[Wed Apr 08 22:05:39.466477 2026] [:error] [pid 12385:tid 12406] [client 45.248.76.214:14434] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adZgsyAjtvRQEkLosq2oagAAABE"]
[Wed Apr 08 22:05:39.524277 2026] [:error] [pid 12385:tid 12401] [client 45.248.76.214:14446] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adZgsyAjtvRQEkLosq2obQAAAAw"]
[Wed Apr 08 22:05:39.669267 2026] [:error] [pid 7047:tid 7054] [client 45.248.76.214:14462] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adZgs-Nh3oGO3pKiCzw7JgAAAYU"]
[Wed Apr 08 22:05:39.694722 2026] [:error] [pid 12453:tid 12469] [client 45.248.76.214:14470] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adZgsxjtW7S6XsLPvrRNSAAAAI4"]
[Wed Apr 08 22:05:39.765412 2026] [:error] [pid 12453:tid 12461] [client 45.248.76.214:14472] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adZgsxjtW7S6XsLPvrRNTQAAAIY"]
[Wed Apr 08 22:05:39.791140 2026] [:error] [pid 12453:tid 12462] [client 45.248.76.214:14476] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adZgsxjtW7S6XsLPvrRNTgAAAIc"]
[Wed Apr 08 22:05:39.850119 2026] [:error] [pid 12490:tid 12496] [client 45.248.76.214:14478] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adZgs21Fea4F4fbumr0Y_QAAAMQ"]
[Wed Apr 08 22:05:39.875253 2026] [:error] [pid 12490:tid 12515] [client 45.248.76.214:14488] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-file.php"] [unique_id "adZgs21Fea4F4fbumr0Y_gAAANc"]
[Wed Apr 08 22:05:39.899487 2026] [:error] [pid 12453:tid 12467] [client 45.248.76.214:14504] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adZgsxjtW7S6XsLPvrRNTwAAAIw"]
[Wed Apr 08 22:05:39.903488 2026] [proxy_fcgi:error] [pid 12453:tid 12467] [client 45.248.76.214:14504] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:39.916324 2026] [:error] [pid 12453:tid 12474] [client 45.248.76.214:14504] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "adZgsxjtW7S6XsLPvrRNUAAAAJM"]
[Wed Apr 08 22:05:39.973669 2026] [:error] [pid 12453:tid 12463] [client 45.248.76.214:14512] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adZgsxjtW7S6XsLPvrRNUwAAAIg"]
[Wed Apr 08 22:05:39.998866 2026] [:error] [pid 12453:tid 12468] [client 45.248.76.214:14524] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/network.php"] [unique_id "adZgsxjtW7S6XsLPvrRNVAAAAI0"]
[Wed Apr 08 22:05:40.139838 2026] [:error] [pid 12453:tid 12475] [client 45.248.76.214:14534] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adZgtBjtW7S6XsLPvrRNXAAAAJQ"]
[Wed Apr 08 22:05:40.165651 2026] [:error] [pid 12453:tid 12476] [client 45.248.76.214:14544] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "adZgtBjtW7S6XsLPvrRNXQAAAJU"]
[Wed Apr 08 22:05:40.221943 2026] [:error] [pid 35642:tid 35659] [client 45.248.76.214:14546] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adZgtA-CqryxdEs5DN9oAAAAAE8"]
[Wed Apr 08 22:05:40.246651 2026] [:error] [pid 12453:tid 12477] [client 45.248.76.214:14548] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/install.php"] [unique_id "adZgtBjtW7S6XsLPvrRNXgAAAJY"]
[Wed Apr 08 22:05:40.277162 2026] [proxy_fcgi:error] [pid 12453:tid 12463] [client 45.248.76.214:14560] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:40.289581 2026] [:error] [pid 12453:tid 12479] [client 45.248.76.214:14560] [client 45.248.76.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.248.76.214, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adZgtBjtW7S6XsLPvrRNYAAAAJg"]
[Wed Apr 08 22:05:40.319283 2026] [:error] [pid 12453:tid 12468] [client 45.248.76.214:14560] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adZgtBjtW7S6XsLPvrRNYgAAAI0"]
[Wed Apr 08 22:05:40.393053 2026] [:error] [pid 12453:tid 12471] [client 45.248.76.214:14564] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adZgtBjtW7S6XsLPvrRNZgAAAJA"]
[Wed Apr 08 22:05:40.434652 2026] [:error] [pid 12453:tid 12475] [client 45.248.76.214:14578] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adZgtBjtW7S6XsLPvrRNaAAAAJQ"]
[Wed Apr 08 22:05:40.459640 2026] [:error] [pid 35642:tid 35644] [client 45.248.76.214:14584] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adZgtA-CqryxdEs5DN9oAQAAAEA"]
[Wed Apr 08 22:05:40.531791 2026] [:error] [pid 35642:tid 35647] [client 45.248.76.214:14588] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adZgtA-CqryxdEs5DN9oBQAAAEM"]
[Wed Apr 08 22:05:40.586628 2026] [:error] [pid 12385:tid 12396] [client 45.248.76.214:14604] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "adZgtCAjtvRQEkLosq2ocQAAAAc"]
[Wed Apr 08 22:05:40.674012 2026] [:error] [pid 12385:tid 12405] [client 45.248.76.214:14610] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adZgtCAjtvRQEkLosq2odgAAABA"]
[Wed Apr 08 22:05:40.698628 2026] [:error] [pid 12453:tid 12467] [client 45.248.76.214:14620] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bypass.php"] [unique_id "adZgtBjtW7S6XsLPvrRNagAAAIw"]
[Wed Apr 08 22:05:40.739658 2026] [:error] [pid 64066:tid 64076] [client 45.248.76.214:14628] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/count.php"] [unique_id "adZgtFR3WucJgr2vZGZe0gAAAUc"]
[Wed Apr 08 22:05:40.856531 2026] [:error] [pid 64066:tid 64074] [client 45.248.76.214:14634] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adZgtFR3WucJgr2vZGZe2QAAAUU"]
[Wed Apr 08 22:05:40.912193 2026] [:error] [pid 64066:tid 64069] [client 45.248.76.214:14646] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com"] [uri "/images/stories/themes.php"] [unique_id "adZgtFR3WucJgr2vZGZe3AAAAUA"]
[Wed Apr 08 22:05:40.924848 2026] [:error] [pid 64066:tid 64077] [client 45.248.76.214:14646] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adZgtFR3WucJgr2vZGZe3QAAAUg"]
[Wed Apr 08 22:05:40.978719 2026] [:error] [pid 64066:tid 64070] [client 45.248.76.214:14654] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adZgtFR3WucJgr2vZGZe4AAAAUE"]
[Wed Apr 08 22:05:41.003366 2026] [:error] [pid 12453:tid 12478] [client 45.248.76.214:14660] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "adZgtRjtW7S6XsLPvrRNawAAAJc"]
[Wed Apr 08 22:05:41.129481 2026] [:error] [pid 64066:tid 64075] [client 45.248.76.214:14670] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adZgtVR3WucJgr2vZGZe5wAAAUY"]
[Wed Apr 08 22:05:41.188353 2026] [:error] [pid 7047:tid 7065] [client 45.248.76.214:14674] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adZgteNh3oGO3pKiCzw7KQAAAZA"]
[Wed Apr 08 22:05:41.229009 2026] [:error] [pid 7047:tid 7055] [client 45.248.76.214:14684] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adZgteNh3oGO3pKiCzw7KwAAAYY"]
[Wed Apr 08 22:05:42.748779 2026] [:error] [pid 12386:tid 12425] [client 45.248.76.214:14692] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adZgthLhhLtqHi2gK7UkCgAAAQk"]
[Wed Apr 08 22:05:42.773522 2026] [:error] [pid 7047:tid 7067] [client 45.248.76.214:14694] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/colour.php"] [unique_id "adZgtuNh3oGO3pKiCzw7LAAAAZI"]
[Wed Apr 08 22:05:42.814387 2026] [:error] [pid 35642:tid 35652] [client 45.248.76.214:14700] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adZgtg-CqryxdEs5DN9oCQAAAEg"]
[Wed Apr 08 22:05:44.348686 2026] [:error] [pid 12385:tid 12399] [client 45.248.76.214:14704] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/include.php"] [unique_id "adZguCAjtvRQEkLosq2odwAAAAo"]
[Wed Apr 08 22:05:44.408389 2026] [:error] [pid 12490:tid 12504] [client 45.248.76.214:14718] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adZguG1Fea4F4fbumr0ZBwAAAMw"]
[Wed Apr 08 22:05:44.463514 2026] [:error] [pid 12490:tid 12494] [client 45.248.76.214:14734] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adZguG1Fea4F4fbumr0ZCgAAAMI"]
[Wed Apr 08 22:05:44.488697 2026] [:error] [pid 12386:tid 12427] [client 45.248.76.214:14740] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "adZguBLhhLtqHi2gK7UkCwAAAQs"]
[Wed Apr 08 22:05:44.578611 2026] [:error] [pid 12386:tid 12438] [client 45.248.76.214:14748] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "adZguBLhhLtqHi2gK7UkEAAAARY"]
[Wed Apr 08 22:05:44.640723 2026] [:error] [pid 64066:tid 64089] [client 45.248.76.214:14756] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adZguFR3WucJgr2vZGZe7wAAAVQ"]
[Wed Apr 08 22:05:44.718456 2026] [:error] [pid 64066:tid 64082] [client 45.248.76.214:14762] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adZguFR3WucJgr2vZGZe8wAAAU0"]
[Wed Apr 08 22:05:44.744932 2026] [:error] [pid 12385:tid 12394] [client 45.248.76.214:14770] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adZguCAjtvRQEkLosq2oeAAAAAU"]
[Wed Apr 08 22:05:44.769853 2026] [:error] [pid 64066:tid 64077] [client 45.248.76.214:14772] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adZguFR3WucJgr2vZGZe9QAAAUg"]
[Wed Apr 08 22:05:44.831249 2026] [:error] [pid 64066:tid 64070] [client 45.248.76.214:14788] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adZguFR3WucJgr2vZGZe-AAAAUE"]
[Wed Apr 08 22:05:44.890130 2026] [:error] [pid 64066:tid 64078] [client 45.248.76.214:14798] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adZguFR3WucJgr2vZGZe-wAAAUk"]
[Wed Apr 08 22:05:44.914976 2026] [:error] [pid 64066:tid 64083] [client 45.248.76.214:14806] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adZguFR3WucJgr2vZGZe_AAAAU4"]
[Wed Apr 08 22:05:44.955023 2026] [:error] [pid 35642:tid 35649] [client 45.248.76.214:14808] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "adZguA-CqryxdEs5DN9oDAAAAEU"]
[Wed Apr 08 22:05:44.980860 2026] [:error] [pid 35642:tid 35654] [client 45.248.76.214:14814] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/simi.php"] [unique_id "adZguA-CqryxdEs5DN9oDQAAAEo"]
[Wed Apr 08 22:05:45.072410 2026] [:error] [pid 7047:tid 7049] [client 45.248.76.214:14816] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adZgueNh3oGO3pKiCzw7MAAAAYA"]
[Wed Apr 08 22:05:45.114703 2026] [:error] [pid 64066:tid 64081] [client 45.248.76.214:9354] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adZguVR3WucJgr2vZGZe_gAAAUw"]
[Wed Apr 08 22:05:45.140391 2026] [:error] [pid 12453:tid 12469] [client 45.248.76.214:9358] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adZguRjtW7S6XsLPvrRNbgAAAI4"]
[Wed Apr 08 22:05:45.190274 2026] [:error] [pid 35642:tid 35651] [client 45.248.76.214:9372] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adZguQ-CqryxdEs5DN9oDgAAAEc"]
[Wed Apr 08 22:05:45.248954 2026] [:error] [pid 7047:tid 7051] [client 45.248.76.214:9384] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adZgueNh3oGO3pKiCzw7MwAAAYI"]
[Wed Apr 08 22:05:45.307518 2026] [:error] [pid 64066:tid 64069] [client 45.248.76.214:9392] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adZguVR3WucJgr2vZGZfAQAAAUA"]
[Wed Apr 08 22:05:45.351637 2026] [:error] [pid 7047:tid 7056] [client 45.248.76.214:9404] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adZgueNh3oGO3pKiCzw7NQAAAYc"]
[Wed Apr 08 22:05:45.394598 2026] [:error] [pid 64066:tid 64093] [client 45.248.76.214:9408] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adZguVR3WucJgr2vZGZfBAAAAVg"]
[Wed Apr 08 22:05:45.516841 2026] [:error] [pid 35642:tid 35657] [client 45.248.76.214:9420] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugin.php"] [unique_id "adZguQ-CqryxdEs5DN9oFQAAAE0"]
[Wed Apr 08 22:05:45.541759 2026] [:error] [pid 12453:tid 12460] [client 45.248.76.214:9426] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adZguRjtW7S6XsLPvrRNbwAAAIU"]
[Wed Apr 08 22:05:45.600125 2026] [:error] [pid 12453:tid 12473] [client 45.248.76.214:9436] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adZguRjtW7S6XsLPvrRNcgAAAJI"]
[Wed Apr 08 22:05:45.691650 2026] [:error] [pid 64066:tid 64088] [client 45.248.76.214:9452] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adZguVR3WucJgr2vZGZfCQAAAVM"]
[Wed Apr 08 22:05:45.749738 2026] [:error] [pid 64066:tid 64074] [client 45.248.76.214:9466] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adZguVR3WucJgr2vZGZfDAAAAUU"]
[Wed Apr 08 22:05:45.804376 2026] [:error] [pid 12453:tid 12478] [client 45.248.76.214:9468] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adZguRjtW7S6XsLPvrRNdQAAAJc"]
[Wed Apr 08 22:05:45.846052 2026] [:error] [pid 12490:tid 12493] [client 45.248.76.214:9472] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adZguW1Fea4F4fbumr0ZDQAAAME"]
[Wed Apr 08 22:05:45.886331 2026] [:error] [pid 12490:tid 12492] [client 45.248.76.214:9474] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "adZguW1Fea4F4fbumr0ZDwAAAMA"]
[Wed Apr 08 22:05:45.976563 2026] [:error] [pid 12490:tid 12498] [client 45.248.76.214:9484] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "adZguW1Fea4F4fbumr0ZFAAAAMY"]
[Wed Apr 08 22:05:46.048631 2026] [:error] [pid 12386:tid 12439] [client 45.248.76.214:9500] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "adZguhLhhLtqHi2gK7UkFAAAARc"]
[Wed Apr 08 22:05:46.080541 2026] [proxy_fcgi:error] [pid 12386:tid 12420] [client 45.248.76.214:9514] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 22:05:46.094528 2026] [:error] [pid 12386:tid 12429] [client 45.248.76.214:9514] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "adZguhLhhLtqHi2gK7UkFgAAAQ0"]
[Wed Apr 08 22:05:46.120593 2026] [:error] [pid 64066:tid 64069] [client 45.248.76.214:9524] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "adZgulR3WucJgr2vZGZfDQAAAUA"]
[Wed Apr 08 22:05:46.188910 2026] [:error] [pid 64066:tid 64092] [client 45.248.76.214:9526] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "adZgulR3WucJgr2vZGZfEAAAAVc"]
[Wed Apr 08 22:05:46.214311 2026] [:error] [pid 64066:tid 64090] [client 45.248.76.214:9530] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "adZgulR3WucJgr2vZGZfEQAAAVU"]
[Wed Apr 08 22:05:46.340658 2026] [:error] [pid 64066:tid 64089] [client 45.248.76.214:9538] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "adZgulR3WucJgr2vZGZfGAAAAVQ"]
[Wed Apr 08 22:05:46.366305 2026] [:error] [pid 64066:tid 64079] [client 45.248.76.214:9546] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "adZgulR3WucJgr2vZGZfGQAAAUo"]
[Wed Apr 08 22:05:46.407123 2026] [:error] [pid 64066:tid 64069] [client 45.248.76.214:9550] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/log.php"] [unique_id "adZgulR3WucJgr2vZGZfGwAAAUA"]
[Wed Apr 08 22:05:46.432860 2026] [:error] [pid 64066:tid 64073] [client 45.248.76.214:9556] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "adZgulR3WucJgr2vZGZfHAAAAUQ"]
[Wed Apr 08 22:05:46.459419 2026] [:error] [pid 7189:tid 7208] [client 45.248.76.214:9558] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "adZguhaBqhBSu0L37lrrEwAAAdE"]
[Wed Apr 08 22:05:46.485935 2026] [:error] [pid 64066:tid 64070] [client 45.248.76.214:9562] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/aw.php"] [unique_id "adZgulR3WucJgr2vZGZfHQAAAUE"]
[Wed Apr 08 22:05:46.572911 2026] [:error] [pid 64066:tid 64078] [client 45.248.76.214:9564] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "adZgulR3WucJgr2vZGZfIgAAAUk"]
[Wed Apr 08 22:05:46.600267 2026] [:error] [pid 64066:tid 64083] [client 45.248.76.214:9574] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/install.php"] [unique_id "adZgulR3WucJgr2vZGZfIwAAAU4"]
[Wed Apr 08 22:05:46.657640 2026] [:error] [pid 12490:tid 12510] [client 45.248.76.214:9582] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "adZgum1Fea4F4fbumr0ZGQAAANI"]
[Wed Apr 08 22:05:46.690784 2026] [:error] [pid 7189:tid 7193] [client 45.248.76.214:9588] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "adZguhaBqhBSu0L37lrrFAAAAcI"]
[Wed Apr 08 22:05:46.832555 2026] [:error] [pid 7189:tid 7200] [client 45.248.76.214:9594] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/template-less.php"] [unique_id "adZguhaBqhBSu0L37lrrFwAAAck"]
[Wed Apr 08 22:05:46.858944 2026] [:error] [pid 7189:tid 7192] [client 45.248.76.214:9598] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "adZguhaBqhBSu0L37lrrGAAAAcE"]
[Wed Apr 08 22:05:47.035514 2026] [:error] [pid 7189:tid 7198] [client 45.248.76.214:9612] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/min.php"] [unique_id "adZguxaBqhBSu0L37lrrIAAAAcc"]
[Wed Apr 08 22:05:47.065408 2026] [:error] [pid 12453:tid 12468] [client 45.248.76.214:9624] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "adZguxjtW7S6XsLPvrRNeAAAAI0"]
[Wed Apr 08 22:05:47.124514 2026] [:error] [pid 12453:tid 12459] [client 45.248.76.214:9630] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/file.php"] [unique_id "adZguxjtW7S6XsLPvrRNewAAAIQ"]
[Wed Apr 08 22:05:47.165875 2026] [:error] [pid 12453:tid 12475] [client 45.248.76.214:9634] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "adZguxjtW7S6XsLPvrRNfQAAAJQ"]
[Wed Apr 08 22:05:47.208110 2026] [:error] [pid 12490:tid 12514] [client 45.248.76.214:9640] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/load.php"] [unique_id "adZgu21Fea4F4fbumr0ZHAAAANY"]
[Wed Apr 08 22:05:47.233297 2026] [:error] [pid 12453:tid 12472] [client 45.248.76.214:9644] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "adZguxjtW7S6XsLPvrRNfgAAAJE"]
[Wed Apr 08 22:05:47.258828 2026] [:error] [pid 12453:tid 12455] [client 45.248.76.214:9646] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "adZguxjtW7S6XsLPvrRNfwAAAIA"]
[Wed Apr 08 22:05:47.332851 2026] [:error] [pid 12385:tid 12395] [client 45.248.76.214:9648] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "adZguyAjtvRQEkLosq2ofQAAAAY"]
[Wed Apr 08 22:05:47.374009 2026] [:error] [pid 7047:tid 7055] [client 45.248.76.214:9650] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "adZgu-Nh3oGO3pKiCzw7NwAAAYY"]
[Wed Apr 08 22:05:47.429652 2026] [:error] [pid 7047:tid 7073] [client 45.248.76.214:9654] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "adZgu-Nh3oGO3pKiCzw7OgAAAZg"]
[Wed Apr 08 22:05:47.454933 2026] [:error] [pid 7047:tid 7068] [client 45.248.76.214:9668] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "adZgu-Nh3oGO3pKiCzw7OwAAAZM"]
[Wed Apr 08 22:05:47.481306 2026] [:error] [pid 35642:tid 35648] [client 45.248.76.214:9678] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "adZguw-CqryxdEs5DN9oGQAAAEQ"]
[Wed Apr 08 22:05:47.630288 2026] [:error] [pid 12453:tid 12457] [client 45.248.76.214:9690] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/system.php"] [unique_id "adZguxjtW7S6XsLPvrRNiAAAAII"]
[Wed Apr 08 22:05:47.674143 2026] [:error] [pid 35642:tid 35664] [client 45.248.76.214:9702] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "adZguw-CqryxdEs5DN9oGwAAAFQ"]
[Wed Apr 08 22:05:47.735886 2026] [:error] [pid 12386:tid 12431] [client 45.248.76.214:9704] [client 45.248.76.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "adZguxLhhLtqHi2gK7UkGQAAAQ8"]
[Wed Apr 08 22:05:47.766579 2026] [:error] [pid 7047:tid 7062] [client 95.173.193.5:63196] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "adZgu-Nh3oGO3pKiCzw7PAAAAY0"]
[Wed Apr 08 22:05:47.801449 2026] [:error] [pid 12490:tid 12506] [client 95.173.193.5:63200] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "adZgu21Fea4F4fbumr0ZHQAAAM4"]
[Wed Apr 08 22:05:47.895985 2026] [:error] [pid 12490:tid 12499] [client 95.173.193.5:63210] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "adZgu21Fea4F4fbumr0ZIAAAAMc"]
[Wed Apr 08 22:05:48.064931 2026] [:error] [pid 12490:tid 12510] [client 95.173.193.5:63222] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "adZgvG1Fea4F4fbumr0ZKAAAANI"]
[Wed Apr 08 22:05:48.175394 2026] [:error] [pid 7047:tid 7066] [client 95.173.193.5:63232] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "adZgvONh3oGO3pKiCzw7QQAAAZE"]
[Wed Apr 08 22:05:48.247101 2026] [:error] [pid 7047:tid 7069] [client 95.173.193.5:63240] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "adZgvONh3oGO3pKiCzw7RAAAAZQ"]
[Wed Apr 08 22:05:48.278501 2026] [:error] [pid 7047:tid 7072] [client 95.173.193.5:63250] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "adZgvONh3oGO3pKiCzw7RQAAAZc"]
[Wed Apr 08 22:05:49.973035 2026] [:error] [pid 7047:tid 7059] [client 95.173.193.5:63258] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "adZgveNh3oGO3pKiCzw7UgAAAYo"]
[Wed Apr 08 22:05:50.003777 2026] [:error] [pid 12385:tid 12407] [client 95.173.193.5:63262] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "adZgviAjtvRQEkLosq2ofgAAABI"]
[Wed Apr 08 22:05:50.035669 2026] [:error] [pid 35642:tid 35653] [client 95.173.193.5:63264] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "adZgvg-CqryxdEs5DN9oHQAAAEk"]
[Wed Apr 08 22:05:50.088445 2026] [:error] [pid 35642:tid 35657] [client 95.173.193.5:63266] [client 95.173.193.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.173.193.5, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "adZgvg-CqryxdEs5DN9oHwAAAE0"]
[Wed Apr 08 22:05:50.127720 2026] [:error] [pid 35642:tid 35666] [client 95.173.193.5:63266] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "adZgvg-CqryxdEs5DN9oIQAAAFY"]
[Wed Apr 08 22:05:50.157931 2026] [:error] [pid 35642:tid 35662] [client 95.173.193.5:63270] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "adZgvg-CqryxdEs5DN9oIgAAAFI"]
[Wed Apr 08 22:05:50.189716 2026] [:error] [pid 64066:tid 64069] [client 95.173.193.5:63278] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "adZgvlR3WucJgr2vZGZfJgAAAUA"]
[Wed Apr 08 22:05:50.346517 2026] [:error] [pid 64066:tid 64080] [client 95.173.193.5:63284] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "adZgvlR3WucJgr2vZGZfLgAAAUs"]
[Wed Apr 08 22:05:50.516020 2026] [:error] [pid 12490:tid 12501] [client 95.173.193.5:63288] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "adZgvm1Fea4F4fbumr0ZMAAAAMk"]
[Wed Apr 08 22:05:50.584459 2026] [:error] [pid 12490:tid 12509] [client 95.173.193.5:63296] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "adZgvm1Fea4F4fbumr0ZMwAAANE"]
[Wed Apr 08 22:05:50.849123 2026] [:error] [pid 12490:tid 12505] [client 95.173.193.5:63312] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "adZgvm1Fea4F4fbumr0ZQAAAAM0"]
[Wed Apr 08 22:05:50.880553 2026] [:error] [pid 35642:tid 35649] [client 95.173.193.5:63314] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "adZgvg-CqryxdEs5DN9oIwAAAEU"]
[Wed Apr 08 22:05:50.913253 2026] [:error] [pid 35642:tid 35654] [client 95.173.193.5:63324] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "adZgvg-CqryxdEs5DN9oJAAAAEo"]
[Wed Apr 08 22:05:50.944115 2026] [:error] [pid 64066:tid 64088] [client 95.173.193.5:63332] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "adZgvlR3WucJgr2vZGZfMAAAAVM"]
[Wed Apr 08 22:05:51.035607 2026] [:error] [pid 7189:tid 7214] [client 95.173.193.5:63334] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "adZgvxaBqhBSu0L37lrrJQAAAdc"]
[Wed Apr 08 22:05:51.067041 2026] [:error] [pid 7189:tid 7195] [client 95.173.193.5:63342] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "adZgvxaBqhBSu0L37lrrJgAAAcQ"]
[Wed Apr 08 22:05:52.686057 2026] [:error] [pid 7047:tid 7073] [client 95.173.193.5:63348] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "adZgwONh3oGO3pKiCzw7XQAAAZg"]
[Wed Apr 08 22:05:52.792553 2026] [:error] [pid 64066:tid 64071] [client 95.173.193.5:63354] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "adZgwFR3WucJgr2vZGZfNwAAAUI"]
[Wed Apr 08 22:05:52.822886 2026] [:error] [pid 12490:tid 12509] [client 95.173.193.5:63366] [client 95.173.193.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "adZgwG1Fea4F4fbumr0ZQwAAANE"]
[Wed Apr 08 22:05:54.558810 2026] [autoindex:error] [pid 64066:tid 64072] [client 95.173.193.5:63382] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 22:53:01.195623 2026] [:error] [pid 64066:tid 64087] [client 170.106.165.76:50990] [client 170.106.165.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adZrzVR3WucJgr2vZGZ8RgAAAVI"]
[Thu Apr 09 01:28:33.367896 2026] [:error] [pid 40055:tid 40139] [client 43.153.15.51:54638] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adaQQX_5SjAJycOw5k_BwgAAAIk"]
[Thu Apr 09 03:32:51.856619 2026] [:error] [pid 54151:tid 54184] [client 20.251.48.95:42434] [client 20.251.48.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adatY7JOoncvNrTXA0QQ1gAAABU"]
[Thu Apr 09 03:47:56.863523 2026] [:error] [pid 20641:tid 20645] [client 72.146.17.160:14801] [client 72.146.17.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adaw7G3LksBSF-6rlkYf9wAAAMA"]
[Thu Apr 09 04:03:42.443182 2026] [:error] [pid 22627:tid 22654] [client 221.229.106.25:54006] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ada0nvr8glsF_jKQpr6YuQAAARg"]
[Thu Apr 09 04:59:27.726452 2026] [:error] [pid 20537:tid 20608] [client 43.173.1.69:42682] [client 43.173.1.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adbBr8STjpSeyrxLmN4DbQAAAIo"]
[Thu Apr 09 08:17:29.144052 2026] [:error] [pid 20641:tid 20650] [client 43.153.96.79:47086] [client 43.153.96.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adbwGW3LksBSF-6rlkauaAAAAMU"]
[Thu Apr 09 08:30:31.725087 2026] [:error] [pid 20641:tid 20647] [client 20.63.32.44:65435] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzJ23LksBSF-6rlka0IQAAAMI"]
[Thu Apr 09 08:30:32.136687 2026] [:error] [pid 20641:tid 20645] [client 20.63.32.44:65414] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKG3LksBSF-6rlka0IwAAAMA"]
[Thu Apr 09 08:30:32.558298 2026] [:error] [pid 20641:tid 20669] [client 20.63.32.44:65492] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKG3LksBSF-6rlka0JQAAANg"]
[Thu Apr 09 08:30:32.968527 2026] [:error] [pid 20537:tid 20604] [client 20.63.32.44:65410] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKMSTjpSeyrxLmN5LAwAAAIY"]
[Thu Apr 09 14:21:01.546052 2026] [:error] [pid 24927:tid 24934] [client 43.130.57.76:32836] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "addFTTXObuzEuw8mNJtvLwAAAQQ"]
[Thu Apr 09 16:45:30.682697 2026] [:error] [pid 24927:tid 24946] [client 49.233.45.47:36048] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "addnKjXObuzEuw8mNJuyXgAAARA"]
[Thu Apr 09 21:07:24.978279 2026] [:error] [pid 24624:tid 24628] [client 23.226.132.115:50050] [client 23.226.132.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adekjO4Jn-WvK1ZBTvjeVwAAAMI"], referer: https://www.baidu.com/s?wd=login
[Thu Apr 09 21:07:52.906719 2026] [:error] [pid 24515:tid 24524] [client 107.189.7.114:58308] [client 107.189.7.114] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||paramountestate.com|F|2"] [data "TX:0=application/qwik-json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adekqK1OMnvM2fMnB1O7oQAAAAU"]
[Thu Apr 09 22:05:29.460157 2026] [:error] [pid 20837:tid 20840] [client 170.106.107.87:57586] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adeyKfSL71FHZkjrGzMEGQAAAYE"]
[Thu Apr 09 22:49:03.302437 2026] [:error] [pid 63331:tid 63352] [client 13.40.198.103:56332] [client 13.40.198.103] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ade8XybKfIYuVjWbE4WZUAAAAdM"], referer: https://www.netflix.com
[Thu Apr 09 22:49:06.177652 2026] [:error] [pid 24516:tid 24555] [client 13.40.198.103:61851] [client 13.40.198.103] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ade8YthW7vSS-UkeWCU-qQAAAEg"], referer: https://www.flickr.com
[Thu Apr 09 22:49:09.964524 2026] [:error] [pid 20837:tid 20857] [client 13.40.198.103:57865] [client 13.40.198.103] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ade8ZfSL71FHZkjrGzMPPwAAAZI"], referer: https://www.tumblr.com
[Thu Apr 09 22:49:12.925720 2026] [:error] [pid 24624:tid 24638] [client 13.40.198.103:61540] [client 13.40.198.103] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ade8aO4Jn-WvK1ZBTvj0kgAAAMw"], referer: https://www.nih.gov
[Thu Apr 09 23:20:05.817715 2026] [:error] [pid 63331:tid 63340] [client 36.111.67.189:41838] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adfDpSbKfIYuVjWbE4WkegAAAcc"]
[Fri Apr 10 00:36:49.578796 2026] [:error] [pid 24515:tid 24521] [client 43.157.22.109:47922] [client 43.157.22.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adfVoa1OMnvM2fMnB1MYawAAAAI"]
[Fri Apr 10 11:59:23.993787 2026] [:error] [pid 13102:tid 13165] [client 192.144.148.122:49560] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adh1m_9xLvjW2guI55aJOgAAAAU"]
[Fri Apr 10 21:04:42.212412 2026] [:error] [pid 13100:tid 13120] [client 223.233.86.160:16340] [client 223.233.86.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.86.160, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adj1alzg-ZkZ0InWIP262gAAAQ8"]
[Fri Apr 10 23:09:40.389424 2026] [:error] [pid 63062:tid 63074] [client 43.156.109.53:53402] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adkStJ2HtsmV85NqkMcJugAAA4o"]
[Sat Apr 11 01:08:43.895150 2026] [:error] [pid 21706:tid 21720] [client 114.80.36.40:54784] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adkumyGQ1M5d8fQSsLF7igAAAAw"]
[Sat Apr 11 01:53:58.452863 2026] [:error] [pid 21706:tid 21729] [client 216.24.210.153:42177] [client 216.24.210.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adk5NiGQ1M5d8fQSsLGloQAAABU"]
[Sat Apr 11 03:30:28.848885 2026] [:error] [pid 21570:tid 21675] [client 43.153.48.240:52154] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adlP1DKs5t9xRSNL6cn4BgAAAEc"]
[Sat Apr 11 08:58:45.801376 2026] [:error] [pid 13721:tid 13741] [client 43.134.35.91:47000] [client 43.134.35.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "admcxQtCFIRABSMvNE68yQAAABE"]
[Sat Apr 11 09:42:42.878174 2026] [:error] [pid 34822:tid 34843] [client 157.15.40.61:60063] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "admnEtoScBMkNZUKMZ3ZtgAAARA"]
[Sat Apr 11 12:21:53.721277 2026] [:error] [pid 2297:tid 2311] [client 103.216.221.80:54666] [client 103.216.221.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.80, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adnMYbXJS-Jji11jZk2oVgAAAQo"]
[Sat Apr 11 12:26:19.007073 2026] [ssl:error] [pid 2297:tid 2302] [client 47.128.112.35:41852] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Sat Apr 11 13:17:41.760368 2026] [:error] [pid 11067:tid 11090] [client 43.152.72.247:45720] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adnZdcW3w7N67R04YCJtmgAAAFU"]
[Sat Apr 11 13:41:50.718005 2026] [:error] [pid 2188:tid 2258] [client 126.209.19.172:50471] [client 126.209.19.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.19.172, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adnfHoDhDA-Xtn2nRScAHQAAAMI"]
[Sat Apr 11 14:11:37.307626 2026] [:error] [pid 11067:tid 11092] [client 157.15.40.61:56166] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "adnmGcW3w7N67R04YCKQbQAAAFc"]
[Sat Apr 11 14:11:37.583533 2026] [:error] [pid 2186:tid 2206] [client 157.15.40.61:56274] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/style.php"] [unique_id "adnmGcibnOEEvcO8wPL9OgAAAJA"]
[Sat Apr 11 14:11:37.840841 2026] [:error] [pid 2187:tid 2234] [client 157.15.40.61:56378] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/themes/style.php"] [unique_id "adnmGQ4J29_qQi0FkjiIGwAAAAY"]
[Sat Apr 11 14:11:38.121831 2026] [:error] [pid 11067:tid 11086] [client 157.15.40.61:56488] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-admin/style.php"] [unique_id "adnmGsW3w7N67R04YCKQvQAAAFE"]
[Sat Apr 11 14:11:39.520165 2026] [:error] [pid 2297:tid 2305] [client 157.15.40.61:56717] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style.php"] [unique_id "adnmG7XJS-Jji11jZk3ZdAAAAQQ"]
[Sat Apr 11 14:11:41.740508 2026] [:error] [pid 11067:tid 11085] [client 157.15.40.61:57138] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "adnmHcW3w7N67R04YCKRMQAAAFA"]
[Sat Apr 11 14:11:42.016482 2026] [:error] [pid 11067:tid 11081] [client 157.15.40.61:57184] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/file.php"] [unique_id "adnmHsW3w7N67R04YCKRVwAAAEw"]
[Sat Apr 11 14:11:43.432931 2026] [:error] [pid 2297:tid 2305] [client 157.15.40.61:57450] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/flower.php"] [unique_id "adnmH7XJS-Jji11jZk3Z-gAAAQQ"]
[Sat Apr 11 14:11:43.717286 2026] [:error] [pid 2297:tid 2305] [client 157.15.40.61:57497] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/gifclass.php"] [unique_id "adnmH7XJS-Jji11jZk3aCgAAAQQ"]
[Sat Apr 11 14:11:43.996341 2026] [:error] [pid 2188:tid 2280] [client 157.15.40.61:57552] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/bless.php"] [unique_id "adnmH4DhDA-Xtn2nRScKHgAAANg"]
[Sat Apr 11 14:11:44.251495 2026] [:error] [pid 11067:tid 11073] [client 157.15.40.61:57612] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/class-t.api.php"] [unique_id "adnmIMW3w7N67R04YCKRyQAAAEQ"]
[Sat Apr 11 14:11:45.651428 2026] [:error] [pid 2187:tid 2233] [client 157.15.40.61:57816] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/blurbs.php"] [unique_id "adnmIQ4J29_qQi0FkjiIoQAAAAU"]
[Sat Apr 11 14:11:45.945490 2026] [:error] [pid 2187:tid 2250] [client 157.15.40.61:57867] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/akcc.php"] [unique_id "adnmIQ4J29_qQi0FkjiIogAAABY"]
[Sat Apr 11 14:11:46.209658 2026] [:error] [pid 2297:tid 2323] [client 157.15.40.61:57928] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/abcd.php"] [unique_id "adnmIrXJS-Jji11jZk3acwAAARY"]
[Sat Apr 11 14:11:47.271393 2026] [:error] [pid 2188:tid 2266] [client 157.15.40.61:58107] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/shelp.php"] [unique_id "adnmI4DhDA-Xtn2nRScKZgAAAMo"]
[Sat Apr 11 14:11:49.560950 2026] [:error] [pid 11067:tid 11092] [client 157.15.40.61:58302] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/cord.php"] [unique_id "adnmJcW3w7N67R04YCKSwAAAAFc"]
[Sat Apr 11 14:30:54.840372 2026] [:error] [pid 2188:tid 2262] [client 94.247.172.129:36551] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adnqnoDhDA-Xtn2nRScUiQAAAMY"]
[Sat Apr 11 16:45:38.111528 2026] [:error] [pid 11067:tid 11085] [client 43.131.32.36:50670] [client 43.131.32.36] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adoKMsW3w7N67R04YCL2sQAAAFA"]
[Sat Apr 11 19:36:47.156739 2026] [:error] [pid 54518:tid 54532] [client 43.167.236.228:42970] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adoyT6Ki5dAhX05ubq1FXAAAAIo"]
[Sat Apr 11 19:58:27.834141 2026] [:error] [pid 18629:tid 18637] [client 36.41.75.167:55986] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ado3Y2W1jXPD9CXRfNRF8AAAAUY"]
[Sat Apr 11 23:04:58.724248 2026] [:error] [pid 42219:tid 42245] [client 90.175.168.82:50704] [client 90.175.168.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.175.168.82, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adpjGg-4IkVbTQx_J-2doQAAAJY"]
[Sun Apr 12 00:49:08.922829 2026] [:error] [pid 45064:tid 45097] [client 209.35.88.123:14299] [client 209.35.88.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.35.88.123, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adp7hJcHBvLyJ6EUhUrbfAAAAUU"]
[Sun Apr 12 02:05:21.393518 2026] [:error] [pid 44701:tid 44789] [client 209.38.77.153:51850] [client 209.38.77.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adqNYRGZAP4MrlxEPFdILQAAAE4"]
[Sun Apr 12 02:40:40.286199 2026] [:error] [pid 36938:tid 36963] [client 49.7.227.204:52174] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adqVqISWpa_VL1JPU6wAYQAAAZc"]
[Sun Apr 12 07:27:47.132740 2026] [:error] [pid 26599:tid 26613] [client 45.154.98.114:51324] [client 45.154.98.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "adrY83G89LXoQbk_rwBYNgAAAUs"]
[Sun Apr 12 07:27:48.161453 2026] [:error] [pid 26599:tid 26605] [client 45.154.98.114:52012] [client 45.154.98.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "adrY9HG89LXoQbk_rwBYNwAAAUM"]
[Sun Apr 12 07:27:49.274073 2026] [:error] [pid 26599:tid 26621] [client 45.154.98.114:53658] [client 45.154.98.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "adrY9XG89LXoQbk_rwBYOgAAAVM"]
[Sun Apr 12 07:27:51.259507 2026] [:error] [pid 26600:tid 26652] [client 45.154.98.114:54478] [client 45.154.98.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/txets.php"] [unique_id "adrY9-1YwAZiXhQKLYqR5gAAAZc"]
[Sun Apr 12 09:00:38.938210 2026] [:error] [pid 60280:tid 60289] [client 20.223.165.215:39857] [client 20.223.165.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.223.165.215, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "adrutnBlLnDOYuIykkg0MQAAAcc"]
[Sun Apr 12 09:03:36.677616 2026] [:error] [pid 25328:tid 25401] [client 182.44.9.147:34862] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adrvaMxUaQZxT-e0YsAw2gAAAFU"]
[Sun Apr 12 09:45:19.937117 2026] [:error] [pid 25328:tid 25387] [client 20.203.242.229:21113] [client 20.203.242.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adr5L8xUaQZxT-e0YsBBNQAAAE8"]
[Sun Apr 12 10:07:41.470572 2026] [:error] [pid 60280:tid 60293] [client 43.153.76.247:35176] [client 43.153.76.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adr-bXBlLnDOYuIykkhbxgAAAcs"]
[Sun Apr 12 15:51:25.656393 2026] [:error] [pid 26600:tid 26653] [client 120.29.79.222:63765] [client 120.29.79.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.29.79.222, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adtO_e1YwAZiXhQKLYoGVgAAAZg"]
[Sun Apr 12 18:48:36.298595 2026] [:error] [pid 25328:tid 25377] [client 104.28.214.122:29661] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "adt4hMxUaQZxT-e0YsAbeQAAAEo"]
[Sun Apr 12 18:48:44.141512 2026] [:error] [pid 25328:tid 25408] [client 104.28.246.122:37023] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-content/style.php"] [unique_id "adt4jMxUaQZxT-e0YsAbvgAAAFg"]
[Sun Apr 12 19:42:44.741207 2026] [:error] [pid 26567:tid 26587] [client 4.223.67.199:47748] [client 4.223.67.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aduFNHhRpg6ptWFyFx21PgAAARI"]
[Sun Apr 12 20:59:34.456717 2026] [:error] [pid 25328:tid 25403] [client 4.232.92.101:45964] [client 4.232.92.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aduXNsxUaQZxT-e0YsBWPgAAAFY"]
[Sun Apr 12 20:59:43.581944 2026] [:error] [pid 26599:tid 26620] [client 4.232.92.101:36437] [client 4.232.92.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "aduXP3G89LXoQbk_rwDeQQAAAVI"]
[Sun Apr 12 21:01:14.104524 2026] [:error] [pid 26600:tid 26631] [client 4.232.92.101:47763] [client 4.232.92.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wincust.php"] [unique_id "aduXmu1YwAZiXhQKLYpWGAAAAYI"]
[Sun Apr 12 22:17:22.072298 2026] [:error] [pid 25329:tid 25400] [client 192.144.148.122:37724] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adupcmdcIYsS8Iyaj13LJQAAAI4"]
[Mon Apr 13 02:31:40.548214 2026] [:error] [pid 32010:tid 32015] [client 137.184.61.119:43252] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "advlDA0nq-t9pXyV1fys8gAAAMM"]
[Mon Apr 13 02:31:41.690485 2026] [:error] [pid 32010:tid 32019] [client 137.184.61.119:56064] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "advlDQ0nq-t9pXyV1fys-QAAAMc"]
[Mon Apr 13 03:21:59.901323 2026] [:error] [pid 32010:tid 32025] [client 137.184.61.119:60392] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "advw1w0nq-t9pXyV1fzDfQAAAM0"]
[Mon Apr 13 03:22:05.710212 2026] [:error] [pid 31605:tid 31653] [client 137.184.61.119:58300] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "advw3W9Py-Y-9VQ02eHiugAAAAo"]
[Mon Apr 13 08:01:46.866446 2026] [:error] [pid 63406:tid 63424] [client 179.57.56.12:53731] [client 179.57.56.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.57.56.12, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "adwyarHZEIkQ0Zmgp5r0dgAAAM0"]
[Mon Apr 13 10:04:23.760668 2026] [:error] [pid 63310:tid 63365] [client 137.184.61.119:43920] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "adxPJ3oXpRU5ztmwPjLMuAAAAFU"]
[Mon Apr 13 11:00:47.448420 2026] [:error] [pid 63406:tid 63435] [client 123.187.240.242:47089] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adxcX7HZEIkQ0Zmgp5pe2gAAANg"]
[Mon Apr 13 11:39:42.717475 2026] [:error] [pid 63406:tid 63424] [client 43.130.100.35:60618] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "adxlfrHZEIkQ0Zmgp5pr9AAAAM0"]
[Mon Apr 13 15:45:20.982800 2026] [:error] [pid 63406:tid 63414] [client 18.232.116.112:65256] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "adyfELHZEIkQ0Zmgp5rRAAAAAMM"], referer: https://www.google.com/
[Mon Apr 13 15:45:22.975688 2026] [:error] [pid 63406:tid 63412] [client 18.232.116.112:57706] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env."] [unique_id "adyfErHZEIkQ0Zmgp5rRGQAAAME"], referer: https://www.google.com/
[Mon Apr 13 15:45:24.972997 2026] [:error] [pid 57183:tid 57207] [client 18.232.116.112:55729] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env/"] [unique_id "adyfFDDO3t8R5NaxzYSanwAAAVY"], referer: https://github.com/
[Mon Apr 13 15:45:26.974244 2026] [:error] [pid 63406:tid 63420] [client 18.232.116.112:61506] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env%00"] [unique_id "adyfFrHZEIkQ0Zmgp5rROAAAAMk"], referer: https://duckduckgo.com/
[Mon Apr 13 15:45:28.958776 2026] [:error] [pid 9314:tid 9335] [client 18.232.116.112:56240] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env%20"] [unique_id "adyfGG_r4W8fX2GWyGShRAAAAZM"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:45:30.935851 2026] [:error] [pid 9314:tid 9332] [client 18.232.116.112:61631] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env%20"] [unique_id "adyfGm_r4W8fX2GWyGShSAAAAZA"], referer: https://duckduckgo.com/
[Mon Apr 13 15:45:34.074097 2026] [:error] [pid 57183:tid 57189] [client 18.232.116.112:55081] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local"] [unique_id "adyfHjDO3t8R5NaxzYSarAAAAUQ"], referer: https://www.bing.com/
[Mon Apr 13 15:45:36.076102 2026] [:error] [pid 9314:tid 9339] [client 18.232.116.112:58728] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local."] [unique_id "adyfIG_r4W8fX2GWyGShXAAAAZc"], referer: https://www.bing.com/
[Mon Apr 13 15:45:38.087800 2026] [:error] [pid 9314:tid 9336] [client 18.232.116.112:55008] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local/"] [unique_id "adyfIm_r4W8fX2GWyGShYgAAAZQ"], referer: https://www.bing.com/
[Mon Apr 13 15:45:40.074768 2026] [:error] [pid 57183:tid 57204] [client 18.232.116.112:61417] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local%00"] [unique_id "adyfJDDO3t8R5NaxzYSaxAAAAVM"], referer: https://github.com/
[Mon Apr 13 15:45:42.067820 2026] [:error] [pid 57183:tid 57206] [client 18.232.116.112:58031] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local%20"] [unique_id "adyfJjDO3t8R5NaxzYSazAAAAVU"], referer: https://www.bing.com/
[Mon Apr 13 15:45:44.088780 2026] [:error] [pid 63406:tid 63430] [client 18.232.116.112:55541] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local%20"] [unique_id "adyfKLHZEIkQ0Zmgp5rRXgAAANM"], referer: https://www.google.com/
[Mon Apr 13 15:45:46.432997 2026] [:error] [pid 63311:tid 63379] [client 18.232.116.112:52929] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production"] [unique_id "adyfKqHjrGN1MqBCVFm7wgAAAIg"], referer: https://duckduckgo.com/
[Mon Apr 13 15:45:48.482728 2026] [:error] [pid 9314:tid 9328] [client 18.232.116.112:61698] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production."] [unique_id "adyfLG_r4W8fX2GWyGShcwAAAYw"], referer: https://github.com/
[Mon Apr 13 15:45:50.467512 2026] [:error] [pid 57183:tid 57206] [client 18.232.116.112:53670] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production/"] [unique_id "adyfLjDO3t8R5NaxzYSa1AAAAVU"], referer: https://www.bing.com/
[Mon Apr 13 15:45:52.447894 2026] [:error] [pid 9314:tid 9316] [client 18.232.116.112:63919] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production%00"] [unique_id "adyfMG_r4W8fX2GWyGShhQAAAYA"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:45:54.433854 2026] [:error] [pid 63309:tid 63318] [client 18.232.116.112:51544] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production%20"] [unique_id "adyfMkpIKZ10weXpf0X1NwAAAAU"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:45:56.475934 2026] [:error] [pid 63310:tid 63349] [client 18.232.116.112:49834] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production%20"] [unique_id "adyfNHoXpRU5ztmwPjIemAAAAEU"], referer: https://www.bing.com/
[Mon Apr 13 15:45:59.547915 2026] [:error] [pid 63310:tid 63345] [client 18.232.116.112:57277] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development"] [unique_id "adyfN3oXpRU5ztmwPjIeowAAAEE"], referer: https://www.bing.com/
[Mon Apr 13 15:46:01.584059 2026] [:error] [pid 57183:tid 57198] [client 18.232.116.112:55833] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development."] [unique_id "adyfOTDO3t8R5NaxzYSa5AAAAU0"], referer: https://www.bing.com/
[Mon Apr 13 15:46:03.553171 2026] [:error] [pid 9314:tid 9327] [client 18.232.116.112:49468] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development/"] [unique_id "adyfO2_r4W8fX2GWyGShmwAAAYs"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:05.526041 2026] [:error] [pid 57183:tid 57191] [client 18.232.116.112:58486] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development%00"] [unique_id "adyfPTDO3t8R5NaxzYSa7wAAAUY"], referer: https://www.bing.com/
[Mon Apr 13 15:46:10.923828 2026] [:error] [pid 57183:tid 57185] [client 18.232.116.112:63378] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development%20"] [unique_id "adyfQjDO3t8R5NaxzYSbHwAAAUA"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:46:12.877791 2026] [:error] [pid 63406:tid 63414] [client 18.232.116.112:58486] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development%20"] [unique_id "adyfRLHZEIkQ0Zmgp5rRqwAAAMM"], referer: https://www.bing.com/
[Mon Apr 13 15:46:15.917542 2026] [:error] [pid 63406:tid 63426] [client 18.232.116.112:56377] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging"] [unique_id "adyfR7HZEIkQ0Zmgp5rRvAAAAM8"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:17.908726 2026] [:error] [pid 63309:tid 63316] [client 18.232.116.112:62810] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging."] [unique_id "adyfSUpIKZ10weXpf0X1QQAAAAM"], referer: https://www.google.com/
[Mon Apr 13 15:46:19.911773 2026] [:error] [pid 57183:tid 57207] [client 18.232.116.112:65339] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging/"] [unique_id "adyfSzDO3t8R5NaxzYSbRwAAAVY"], referer: https://www.google.com/
[Mon Apr 13 15:46:21.994670 2026] [:error] [pid 63310:tid 63365] [client 18.232.116.112:62590] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging%00"] [unique_id "adyfTXoXpRU5ztmwPjIetQAAAFU"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:46:24.029111 2026] [:error] [pid 7228:tid 7245] [client 18.232.116.112:58702] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging%20"] [unique_id "adyfUAEnn1dQrOSHHNU-NgAAAQ8"], referer: https://www.bing.com/
[Mon Apr 13 15:46:26.057009 2026] [:error] [pid 9314:tid 9333] [client 18.232.116.112:54501] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.staging%20"] [unique_id "adyfUm_r4W8fX2GWyGShugAAAZE"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:28.384528 2026] [:error] [pid 57183:tid 57207] [client 18.232.116.112:49338] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test"] [unique_id "adyfVDDO3t8R5NaxzYSbVgAAAVY"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:30.370448 2026] [:error] [pid 7228:tid 7246] [client 18.232.116.112:57588] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test."] [unique_id "adyfVgEnn1dQrOSHHNU-RAAAARA"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:32.393379 2026] [:error] [pid 9314:tid 9326] [client 18.232.116.112:54364] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test/"] [unique_id "adyfWG_r4W8fX2GWyGShvgAAAYo"], referer: https://www.google.com/
[Mon Apr 13 15:46:34.380954 2026] [:error] [pid 63311:tid 63389] [client 18.232.116.112:59840] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test%00"] [unique_id "adyfWqHjrGN1MqBCVFm76QAAAJI"], referer: https://www.bing.com/
[Mon Apr 13 15:46:36.448603 2026] [:error] [pid 63406:tid 63421] [client 18.232.116.112:62312] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test%20"] [unique_id "adyfXLHZEIkQ0Zmgp5rR2QAAAMo"], referer: https://www.google.com/
[Mon Apr 13 15:46:38.469159 2026] [:error] [pid 57183:tid 57186] [client 18.232.116.112:56079] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.test%20"] [unique_id "adyfXjDO3t8R5NaxzYSbYgAAAUE"], referer: https://github.com/
[Mon Apr 13 15:46:41.599007 2026] [:error] [pid 57183:tid 57196] [client 18.232.116.112:58745] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup"] [unique_id "adyfYTDO3t8R5NaxzYSbawAAAUs"], referer: https://www.google.com/
[Mon Apr 13 15:46:43.754560 2026] [:error] [pid 9314:tid 9326] [client 18.232.116.112:53348] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup."] [unique_id "adyfY2_r4W8fX2GWyGShzAAAAYo"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:45.781166 2026] [:error] [pid 7228:tid 7236] [client 18.232.116.112:59275] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup/"] [unique_id "adyfZQEnn1dQrOSHHNU-YQAAAQY"], referer: https://duckduckgo.com/
[Mon Apr 13 15:46:47.763472 2026] [:error] [pid 9314:tid 9333] [client 18.232.116.112:59106] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup%00"] [unique_id "adyfZ2_r4W8fX2GWyGSh1QAAAZE"], referer: https://github.com/
[Mon Apr 13 15:46:49.781552 2026] [:error] [pid 57183:tid 57194] [client 18.232.116.112:56224] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup%20"] [unique_id "adyfaTDO3t8R5NaxzYSbgAAAAUk"], referer: https://www.bing.com/
[Mon Apr 13 15:46:51.804330 2026] [:error] [pid 63406:tid 63427] [client 18.232.116.112:55519] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.backup%20"] [unique_id "adyfa7HZEIkQ0Zmgp5rR8wAAANA"], referer: https://www.google.com/
[Mon Apr 13 15:46:54.895031 2026] [:error] [pid 63406:tid 63431] [client 18.232.116.112:53674] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old"] [unique_id "adyfbrHZEIkQ0Zmgp5rSBQAAANQ"], referer: https://github.com/
[Mon Apr 13 15:46:56.870979 2026] [:error] [pid 63406:tid 63434] [client 18.232.116.112:56919] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old."] [unique_id "adyfcLHZEIkQ0Zmgp5rSDwAAANc"], referer: https://github.com/
[Mon Apr 13 15:46:58.900671 2026] [:error] [pid 63406:tid 63418] [client 18.232.116.112:63565] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old/"] [unique_id "adyfcrHZEIkQ0Zmgp5rSJAAAAMc"], referer: https://github.com/
[Mon Apr 13 15:47:00.899908 2026] [:error] [pid 63406:tid 63422] [client 18.232.116.112:51024] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old%00"] [unique_id "adyfdLHZEIkQ0Zmgp5rSMQAAAMs"], referer: https://www.google.com/
[Mon Apr 13 15:47:02.895246 2026] [:error] [pid 9314:tid 9339] [client 18.232.116.112:58408] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old%20"] [unique_id "adyfdm_r4W8fX2GWyGSh-wAAAZc"], referer: https://www.google.com/
[Mon Apr 13 15:47:04.891291 2026] [:error] [pid 63406:tid 63429] [client 18.232.116.112:54589] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.old%20"] [unique_id "adyfeLHZEIkQ0Zmgp5rSPwAAANI"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:08.030092 2026] [:error] [pid 63311:tid 63390] [client 18.232.116.112:62413] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save"] [unique_id "adyffKHjrGN1MqBCVFm79QAAAJM"], referer: https://www.bing.com/
[Mon Apr 13 15:47:10.014969 2026] [:error] [pid 63406:tid 63423] [client 18.232.116.112:60246] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save."] [unique_id "adyffrHZEIkQ0Zmgp5rSUwAAAMw"], referer: https://www.bing.com/
[Mon Apr 13 15:47:12.074317 2026] [:error] [pid 9314:tid 9323] [client 18.232.116.112:64023] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save/"] [unique_id "adyfgG_r4W8fX2GWyGSiFAAAAYc"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:14.119464 2026] [:error] [pid 63406:tid 63420] [client 18.232.116.112:53997] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save%00"] [unique_id "adyfgrHZEIkQ0Zmgp5rSbwAAAMk"], referer: https://www.bing.com/
[Mon Apr 13 15:47:16.139037 2026] [:error] [pid 63406:tid 63411] [client 18.232.116.112:60669] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save%20"] [unique_id "adyfhLHZEIkQ0Zmgp5rSdQAAAMA"], referer: https://github.com/
[Mon Apr 13 15:47:18.135541 2026] [:error] [pid 63406:tid 63421] [client 18.232.116.112:61929] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.save%20"] [unique_id "adyfhrHZEIkQ0Zmgp5rSewAAAMo"], referer: https://github.com/
[Mon Apr 13 15:47:21.340836 2026] [:error] [pid 57183:tid 57201] [client 18.232.116.112:54131] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example"] [unique_id "adyfiTDO3t8R5NaxzYSbxwAAAVA"], referer: https://github.com/
[Mon Apr 13 15:47:23.366028 2026] [:error] [pid 63309:tid 63330] [client 18.232.116.112:63096] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example."] [unique_id "adyfi0pIKZ10weXpf0X1YQAAABE"], referer: https://www.bing.com/
[Mon Apr 13 15:47:25.373719 2026] [:error] [pid 63311:tid 63380] [client 18.232.116.112:53584] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example/"] [unique_id "adyfjaHjrGN1MqBCVFm7_gAAAIk"], referer: https://www.google.com/
[Mon Apr 13 15:47:27.391905 2026] [:error] [pid 63309:tid 63326] [client 18.232.116.112:58454] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example%00"] [unique_id "adyfj0pIKZ10weXpf0X1YwAAAA0"], referer: https://www.bing.com/
[Mon Apr 13 15:47:29.376045 2026] [:error] [pid 63309:tid 63313] [client 18.232.116.112:58807] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example%20"] [unique_id "adyfkUpIKZ10weXpf0X1ZwAAAAA"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:31.402593 2026] [:error] [pid 63311:tid 63394] [client 18.232.116.112:53381] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example%20"] [unique_id "adyfk6HjrGN1MqBCVFm8EQAAAJc"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:34.502211 2026] [:error] [pid 63311:tid 63389] [client 18.232.116.112:57429] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local"] [unique_id "adyflqHjrGN1MqBCVFm8GwAAAJI"], referer: https://www.bing.com/
[Mon Apr 13 15:47:36.516128 2026] [:error] [pid 63406:tid 63414] [client 18.232.116.112:58630] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local."] [unique_id "adyfmLHZEIkQ0Zmgp5rSsgAAAMM"], referer: https://www.google.com/
[Mon Apr 13 15:47:38.523917 2026] [:error] [pid 9314:tid 9324] [client 18.232.116.112:57636] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local/"] [unique_id "adyfmm_r4W8fX2GWyGSiNgAAAYg"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:40.544824 2026] [:error] [pid 7228:tid 7250] [client 18.232.116.112:53023] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local%00"] [unique_id "adyfnAEnn1dQrOSHHNU-fgAAARQ"], referer: https://www.bing.com/
[Mon Apr 13 15:47:42.593503 2026] [:error] [pid 63310:tid 63365] [client 18.232.116.112:52404] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local%20"] [unique_id "adyfnnoXpRU5ztmwPjIe1wAAAFU"], referer: https://duckduckgo.com/
[Mon Apr 13 15:47:44.601310 2026] [:error] [pid 7228:tid 7237] [client 18.232.116.112:54043] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.production.local%20"] [unique_id "adyfoAEnn1dQrOSHHNU-hwAAAQc"], referer: https://www.bing.com/
[Mon Apr 13 15:47:47.680639 2026] [:error] [pid 7228:tid 7236] [client 18.232.116.112:50449] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local"] [unique_id "adyfowEnn1dQrOSHHNU-igAAAQY"], referer: https://www.google.com/
[Mon Apr 13 15:47:49.802439 2026] [:error] [pid 63309:tid 63334] [client 18.232.116.112:56130] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local."] [unique_id "adyfpUpIKZ10weXpf0X1dgAAABU"], referer: https://www.google.com/
[Mon Apr 13 15:47:51.774464 2026] [:error] [pid 57183:tid 57189] [client 18.232.116.112:65359] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local/"] [unique_id "adyfpzDO3t8R5NaxzYSb8gAAAUQ"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:53.769340 2026] [:error] [pid 63406:tid 63428] [client 18.232.116.112:59358] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local%00"] [unique_id "adyfqbHZEIkQ0Zmgp5rS3AAAANE"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:47:55.837195 2026] [:error] [pid 57183:tid 57188] [client 18.232.116.112:54964] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local%20"] [unique_id "adyfqzDO3t8R5NaxzYSb9gAAAUM"], referer: https://duckduckgo.com/
[Mon Apr 13 15:47:57.828928 2026] [:error] [pid 63406:tid 63416] [client 18.232.116.112:63232] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.development.local%20"] [unique_id "adyfrbHZEIkQ0Zmgp5rS9gAAAMU"], referer: https://www.bing.com/
[Mon Apr 13 15:48:00.867142 2026] [:error] [pid 57183:tid 57198] [client 18.232.116.112:50958] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist"] [unique_id "adyfsDDO3t8R5NaxzYScEAAAAU0"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:48:02.839975 2026] [:error] [pid 63406:tid 63418] [client 18.232.116.112:53295] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist."] [unique_id "adyfsrHZEIkQ0Zmgp5rS_QAAAMc"], referer: https://github.com/
[Mon Apr 13 15:48:04.831694 2026] [:error] [pid 63310:tid 63368] [client 18.232.116.112:52664] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist/"] [unique_id "adyftHoXpRU5ztmwPjIe5AAAAFg"], referer: https://github.com/
[Mon Apr 13 15:48:07.526525 2026] [:error] [pid 63406:tid 63411] [client 18.232.116.112:64268] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist%00"] [unique_id "adyft7HZEIkQ0Zmgp5rTGAAAAMA"], referer: https://duckduckgo.com/
[Mon Apr 13 15:48:09.581916 2026] [:error] [pid 63406:tid 63414] [client 18.232.116.112:55148] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist%20"] [unique_id "adyfubHZEIkQ0Zmgp5rTJQAAAMM"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:48:11.452484 2026] [:error] [pid 9314:tid 9329] [client 18.232.116.112:63640] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.dist%20"] [unique_id "adyfu2_r4W8fX2GWyGSicAAAAY0"], referer: https://www.google.com/
[Mon Apr 13 15:48:14.497877 2026] [:error] [pid 57183:tid 57208] [client 18.232.116.112:55609] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample"] [unique_id "adyfvjDO3t8R5NaxzYScWAAAAVc"], referer: https://www.bing.com/
[Mon Apr 13 15:48:16.482469 2026] [:error] [pid 9314:tid 9330] [client 18.232.116.112:59038] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample."] [unique_id "adyfwG_r4W8fX2GWyGSihQAAAY4"], referer: https://www.bing.com/
[Mon Apr 13 15:48:18.501950 2026] [:error] [pid 9314:tid 9334] [client 18.232.116.112:55384] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample/"] [unique_id "adyfwm_r4W8fX2GWyGSijAAAAZI"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:48:20.449463 2026] [:error] [pid 9314:tid 9340] [client 18.232.116.112:64600] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample%00"] [unique_id "adyfxG_r4W8fX2GWyGSilwAAAZg"], referer: https://www.google.com/
[Mon Apr 13 15:48:22.550148 2026] [:error] [pid 7228:tid 7244] [client 18.232.116.112:57899] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample%20"] [unique_id "adyfxgEnn1dQrOSHHNU-owAAAQ4"], referer: https://duckduckgo.com/
[Mon Apr 13 15:48:24.535410 2026] [:error] [pid 63406:tid 63432] [client 18.232.116.112:50890] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.sample%20"] [unique_id "adyfyLHZEIkQ0Zmgp5rTPQAAANU"], referer: https://www.google.com/
[Mon Apr 13 15:48:27.560899 2026] [:error] [pid 7228:tid 7245] [client 18.232.116.112:64784] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.template"] [unique_id "adyfywEnn1dQrOSHHNU-qAAAAQ8"], referer: https://duckduckgo.com/
[Mon Apr 13 15:48:29.545466 2026] [:error] [pid 57183:tid 57192] [client 18.232.116.112:58237] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.template."] [unique_id "adyfzTDO3t8R5NaxzYSciAAAAUc"], referer: https://www.bing.com/
[Mon Apr 13 15:48:31.501800 2026] [:error] [pid 63406:tid 63420] [client 18.232.116.112:61016] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.template/"] [unique_id "adyfz7HZEIkQ0Zmgp5rTTAAAAMk"], referer: https://duckduckgo.com/
[Mon Apr 13 15:48:33.451186 2026] [:error] [pid 63310:tid 63363] [client 18.232.116.112:56734] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.template%00"] [unique_id "adyf0XoXpRU5ztmwPjIe6gAAAFM"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:48:35.417809 2026] [:error] [pid 63406:tid 63417] [client 18.232.116.112:55732] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.template%20"] [unique_id "adyf07HZEIkQ0Zmgp5rTWAAAAMY"], referer: https://github.com/
[Mon Apr 13 15:48:37.417746 2026] [:error] [pid 57183:tid 57190] [client 18.232.116.112:49640] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.template%20"] [unique_id "adyf1TDO3t8R5NaxzYScoQAAAUU"], referer: https://duckduckgo.com/
[Mon Apr 13 15:48:40.458102 2026] [:error] [pid 63406:tid 63434] [client 18.232.116.112:51799] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example.local"] [unique_id "adyf2LHZEIkQ0Zmgp5rTbgAAANc"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:48:42.427034 2026] [:error] [pid 9314:tid 9317] [client 18.232.116.112:55973] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example.local."] [unique_id "adyf2m_r4W8fX2GWyGSivgAAAYE"], referer: https://www.google.com/
[Mon Apr 13 15:48:44.380765 2026] [:error] [pid 9314:tid 9336] [client 18.232.116.112:57021] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example.local/"] [unique_id "adyf3G_r4W8fX2GWyGSiwQAAAZQ"], referer: https://www.google.com/
[Mon Apr 13 15:48:46.387227 2026] [:error] [pid 57183:tid 57186] [client 18.232.116.112:53824] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example.local%00"] [unique_id "adyf3jDO3t8R5NaxzYScsAAAAUE"], referer: https://www.google.com/
[Mon Apr 13 15:48:48.352522 2026] [:error] [pid 57183:tid 57186] [client 18.232.116.112:59087] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example.local%20"] [unique_id "adyf4DDO3t8R5NaxzYScxwAAAUE"], referer: https://www.google.com/
[Mon Apr 13 15:48:50.331629 2026] [:error] [pid 57183:tid 57197] [client 18.232.116.112:56330] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.example.local%20"] [unique_id "adyf4jDO3t8R5NaxzYSc2gAAAUw"], referer: https://www.google.com/
[Mon Apr 13 15:48:54.448553 2026] [:error] [pid 63406:tid 63414] [client 18.232.116.112:60580] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker"] [unique_id "adyf5rHZEIkQ0Zmgp5rTkQAAAMM"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:48:56.397179 2026] [:error] [pid 63311:tid 63374] [client 18.232.116.112:58083] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker."] [unique_id "adyf6KHjrGN1MqBCVFm8lgAAAIM"], referer: https://duckduckgo.com/
[Mon Apr 13 15:48:58.349697 2026] [:error] [pid 63406:tid 63416] [client 18.232.116.112:62653] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker/"] [unique_id "adyf6rHZEIkQ0Zmgp5rTqAAAAMU"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:49:00.315180 2026] [:error] [pid 63406:tid 63431] [client 18.232.116.112:59524] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker%00"] [unique_id "adyf7LHZEIkQ0Zmgp5rTsAAAANQ"], referer: https://github.com/
[Mon Apr 13 15:49:02.255170 2026] [:error] [pid 9314:tid 9320] [client 18.232.116.112:62619] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker%20"] [unique_id "adyf7m_r4W8fX2GWyGSjEAAAAYQ"], referer: https://www.bing.com/
[Mon Apr 13 15:49:04.219658 2026] [:error] [pid 7228:tid 7251] [client 18.232.116.112:51057] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.docker%20"] [unique_id "adyf8AEnn1dQrOSHHNU-yAAAARU"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:49:07.257020 2026] [:error] [pid 57183:tid 57194] [client 18.232.116.112:50945] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.ci"] [unique_id "adyf8zDO3t8R5NaxzYSc_AAAAUk"], referer: https://www.bing.com/
[Mon Apr 13 15:49:09.323463 2026] [:error] [pid 57183:tid 57191] [client 18.232.116.112:49697] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.ci."] [unique_id "adyf9TDO3t8R5NaxzYSdCwAAAUY"], referer: https://duckduckgo.com/
[Mon Apr 13 15:49:11.326865 2026] [:error] [pid 63311:tid 63372] [client 18.232.116.112:53310] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.ci/"] [unique_id "adyf96HjrGN1MqBCVFm8oQAAAIE"], referer: https://www.bing.com/
[Mon Apr 13 15:49:13.274058 2026] [:error] [pid 63309:tid 63327] [client 18.232.116.112:56916] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.ci%00"] [unique_id "adyf-UpIKZ10weXpf0X1wQAAAA4"], referer: https://duckduckgo.com/
[Mon Apr 13 15:49:15.236562 2026] [:error] [pid 63406:tid 63412] [client 18.232.116.112:54288] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.ci%20"] [unique_id "adyf-7HZEIkQ0Zmgp5rT5AAAAME"], referer: https://duckduckgo.com/
[Mon Apr 13 15:49:17.236254 2026] [:error] [pid 57183:tid 57204] [client 18.232.116.112:54188] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.ci%20"] [unique_id "adyf_TDO3t8R5NaxzYSdKAAAAVM"], referer: https://github.com/
[Mon Apr 13 15:49:20.307992 2026] [:error] [pid 63311:tid 63388] [client 18.232.116.112:57989] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.live"] [unique_id "adygAKHjrGN1MqBCVFm8sQAAAJE"], referer: https://duckduckgo.com/
[Mon Apr 13 15:49:22.294331 2026] [:error] [pid 63310:tid 63368] [client 18.232.116.112:53074] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.live."] [unique_id "adygAnoXpRU5ztmwPjIfDQAAAFg"], referer: https://github.com/
[Mon Apr 13 15:49:24.378684 2026] [:error] [pid 9314:tid 9322] [client 18.232.116.112:55735] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.live/"] [unique_id "adygBG_r4W8fX2GWyGSjKgAAAYY"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:49:26.856130 2026] [:error] [pid 63406:tid 63433] [client 18.232.116.112:49527] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.live%00"] [unique_id "adygBrHZEIkQ0Zmgp5rUBwAAANY"], referer: https://www.bing.com/
[Mon Apr 13 15:49:28.823748 2026] [:error] [pid 57183:tid 57196] [client 18.232.116.112:59444] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.live%20"] [unique_id "adygCDDO3t8R5NaxzYSdOAAAAUs"], referer: https://github.com/
[Mon Apr 13 15:49:30.788013 2026] [:error] [pid 63311:tid 63374] [client 18.232.116.112:64671] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.live%20"] [unique_id "adygCqHjrGN1MqBCVFm8vQAAAIM"], referer: https://www.google.com/
[Mon Apr 13 15:49:34.552620 2026] [:error] [pid 63406:tid 63427] [client 18.232.116.112:57391] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod"] [unique_id "adygDrHZEIkQ0Zmgp5rUFQAAANA"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:49:36.569612 2026] [:error] [pid 63406:tid 63422] [client 18.232.116.112:61019] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod."] [unique_id "adygELHZEIkQ0Zmgp5rUJQAAAMs"], referer: https://github.com/
[Mon Apr 13 15:49:38.556845 2026] [:error] [pid 63406:tid 63414] [client 18.232.116.112:60698] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod/"] [unique_id "adygErHZEIkQ0Zmgp5rULQAAAMM"], referer: https://www.bing.com/
[Mon Apr 13 15:49:40.532355 2026] [:error] [pid 57183:tid 57192] [client 18.232.116.112:63834] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod%00"] [unique_id "adygFDDO3t8R5NaxzYSdYgAAAUc"], referer: https://duckduckgo.com/
[Mon Apr 13 15:49:42.542839 2026] [:error] [pid 63309:tid 63337] [client 18.232.116.112:59512] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod%20"] [unique_id "adygFkpIKZ10weXpf0X1zAAAABg"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:49:44.527121 2026] [:error] [pid 63406:tid 63412] [client 18.232.116.112:61910] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.prod%20"] [unique_id "adygGLHZEIkQ0Zmgp5rUOwAAAME"], referer: https://www.google.com/
[Mon Apr 13 15:49:47.548655 2026] [:error] [pid 57183:tid 57195] [client 18.232.116.112:61494] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.release"] [unique_id "adygGzDO3t8R5NaxzYSdhwAAAUo"], referer: https://github.com/
[Mon Apr 13 15:49:49.638374 2026] [:error] [pid 63310:tid 63351] [client 18.232.116.112:54056] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.release."] [unique_id "adygHXoXpRU5ztmwPjIfHQAAAEc"], referer: https://github.com/
[Mon Apr 13 15:49:51.649817 2026] [:error] [pid 9314:tid 9330] [client 18.232.116.112:59797] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.release/"] [unique_id "adygH2_r4W8fX2GWyGSjaAAAAY4"], referer: https://www.google.com/
[Mon Apr 13 15:49:53.628583 2026] [:error] [pid 63406:tid 63435] [client 18.232.116.112:58330] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.release%00"] [unique_id "adygIbHZEIkQ0Zmgp5rUSwAAANg"], referer: https://www.bing.com/
[Mon Apr 13 15:49:55.607996 2026] [:error] [pid 9314:tid 9328] [client 18.232.116.112:50635] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.release%20"] [unique_id "adygI2_r4W8fX2GWyGSjdAAAAYw"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:49:57.608846 2026] [:error] [pid 7228:tid 7246] [client 18.232.116.112:56385] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.release%20"] [unique_id "adygJQEnn1dQrOSHHNU_AQAAARA"], referer: https://www.google.com/
[Mon Apr 13 15:50:00.654325 2026] [:error] [pid 63309:tid 63314] [client 18.232.116.112:63916] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.uat"] [unique_id "adygKEpIKZ10weXpf0X10QAAAAE"], referer: https://github.com/
[Mon Apr 13 15:50:02.646251 2026] [:error] [pid 63406:tid 63429] [client 18.232.116.112:55460] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.uat."] [unique_id "adygKrHZEIkQ0Zmgp5rUdQAAANI"], referer: https://www.google.com/
[Mon Apr 13 15:50:04.629868 2026] [:error] [pid 7228:tid 7244] [client 18.232.116.112:61307] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.uat/"] [unique_id "adygLAEnn1dQrOSHHNU_EAAAAQ4"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:50:09.311664 2026] [:error] [pid 7228:tid 7247] [client 18.232.116.112:61297] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.uat%00"] [unique_id "adygMQEnn1dQrOSHHNU_GwAAARE"], referer: https://duckduckgo.com/
[Mon Apr 13 15:50:11.251304 2026] [:error] [pid 63406:tid 63421] [client 18.232.116.112:56867] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.uat%20"] [unique_id "adygM7HZEIkQ0Zmgp5rUiAAAAMo"], referer: https://github.com/
[Mon Apr 13 15:50:13.202142 2026] [:error] [pid 63311:tid 63388] [client 18.232.116.112:63065] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.uat%20"] [unique_id "adygNaHjrGN1MqBCVFm84AAAAJE"], referer: https://github.com/
[Mon Apr 13 15:50:16.201485 2026] [:error] [pid 63309:tid 63324] [client 18.232.116.112:51112] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.deploy"] [unique_id "adygOEpIKZ10weXpf0X11wAAAAs"], referer: https://github.com/
[Mon Apr 13 15:50:18.167138 2026] [:error] [pid 7228:tid 7233] [client 18.232.116.112:54358] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.deploy."] [unique_id "adygOgEnn1dQrOSHHNU_IgAAAQM"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:50:20.150073 2026] [:error] [pid 57183:tid 57191] [client 18.232.116.112:61368] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.deploy/"] [unique_id "adygPDDO3t8R5NaxzYSdtgAAAUY"], referer: https://duckduckgo.com/
[Mon Apr 13 15:50:22.122368 2026] [:error] [pid 9314:tid 9335] [client 18.232.116.112:61547] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.deploy%00"] [unique_id "adygPm_r4W8fX2GWyGSjwAAAAZM"], referer: https://www.google.com/
[Mon Apr 13 15:50:24.145392 2026] [:error] [pid 57183:tid 57203] [client 18.232.116.112:52060] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.deploy%20"] [unique_id "adygQDDO3t8R5NaxzYSdxAAAAVI"], referer: https://www.bing.com/
[Mon Apr 13 15:50:26.106059 2026] [:error] [pid 9314:tid 9326] [client 18.232.116.112:61644] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.deploy%20"] [unique_id "adygQm_r4W8fX2GWyGSjywAAAYo"], referer: https://github.com/
[Mon Apr 13 15:50:31.368791 2026] [:error] [pid 63406:tid 63420] [client 18.232.116.112:58128] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php"] [unique_id "adygR7HZEIkQ0Zmgp5rUtAAAAMk"], referer: https://github.com/
[Mon Apr 13 15:50:33.349753 2026] [:error] [pid 63309:tid 63327] [client 18.232.116.112:62045] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php."] [unique_id "adygSUpIKZ10weXpf0X13wAAAA4"], referer: https://duckduckgo.com/
[Mon Apr 13 15:50:35.318016 2026] [:error] [pid 63406:tid 63423] [client 18.232.116.112:63176] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php/"] [unique_id "adygS7HZEIkQ0Zmgp5rUwwAAAMw"], referer: https://www.bing.com/
[Mon Apr 13 15:50:37.309611 2026] [:error] [pid 63406:tid 63433] [client 18.232.116.112:63444] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php%00"] [unique_id "adygTbHZEIkQ0Zmgp5rUyAAAANY"], referer: https://duckduckgo.com/
[Mon Apr 13 15:50:39.278063 2026] [:error] [pid 57183:tid 57208] [client 18.232.116.112:59065] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php%20"] [unique_id "adygTzDO3t8R5NaxzYSd7wAAAVc"], referer: https://www.google.com/
[Mon Apr 13 15:50:41.253141 2026] [:error] [pid 57183:tid 57205] [client 18.232.116.112:53696] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php%20"] [unique_id "adygUTDO3t8R5NaxzYSd_AAAAVQ"], referer: https://www.bing.com/
[Mon Apr 13 15:50:52.640769 2026] [:error] [pid 57183:tid 57194] [client 18.232.116.112:58729] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/config.ini"] [unique_id "adygXDDO3t8R5NaxzYSeLQAAAUk"], referer: https://duckduckgo.com/
[Mon Apr 13 15:51:01.229132 2026] [:error] [pid 57183:tid 57208] [client 18.232.116.112:58729] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config"] [unique_id "adygZTDO3t8R5NaxzYSeOwAAAVc"], referer: https://github.com/
[Mon Apr 13 15:51:03.237623 2026] [:error] [pid 63309:tid 63329] [client 18.232.116.112:57530] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config."] [unique_id "adygZ0pIKZ10weXpf0X18wAAABA"], referer: https://github.com/
[Mon Apr 13 15:51:05.219811 2026] [:error] [pid 63406:tid 63435] [client 18.232.116.112:55222] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config/"] [unique_id "adygabHZEIkQ0Zmgp5rVEAAAANg"], referer: https://www.google.com/
[Mon Apr 13 15:51:07.213059 2026] [:error] [pid 63406:tid 63422] [client 18.232.116.112:54715] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config%00"] [unique_id "adyga7HZEIkQ0Zmgp5rVGwAAAMs"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:51:09.221265 2026] [:error] [pid 63406:tid 63429] [client 18.232.116.112:58414] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config%20"] [unique_id "adygbbHZEIkQ0Zmgp5rVKQAAANI"], referer: https://www.google.com/
[Mon Apr 13 15:51:11.196417 2026] [:error] [pid 63406:tid 63434] [client 18.232.116.112:62290] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config%20"] [unique_id "adygb7HZEIkQ0Zmgp5rVPAAAANc"], referer: https://github.com/
[Mon Apr 13 15:51:14.255676 2026] [:error] [pid 9314:tid 9336] [client 18.232.116.112:62699] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".config"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/app.config"] [unique_id "adygcm_r4W8fX2GWyGSkPgAAAZQ"], referer: https://duckduckgo.com/
[Mon Apr 13 15:51:26.998189 2026] [:error] [pid 9314:tid 9328] [client 18.232.116.112:62699] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php"] [unique_id "adygfm_r4W8fX2GWyGSkbQAAAYw"], referer: https://www.bing.com/
[Mon Apr 13 15:51:28.976576 2026] [:error] [pid 63406:tid 63412] [client 18.232.116.112:60907] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php."] [unique_id "adyggLHZEIkQ0Zmgp5rVgAAAAME"], referer: https://github.com/
[Mon Apr 13 15:51:30.995634 2026] [:error] [pid 63406:tid 63419] [client 18.232.116.112:62703] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php/"] [unique_id "adyggrHZEIkQ0Zmgp5rViAAAAMg"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:51:33.000726 2026] [:error] [pid 63406:tid 63415] [client 18.232.116.112:51345] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php%00"] [unique_id "adyghLHZEIkQ0Zmgp5rVjQAAAMQ"], referer: https://github.com/
[Mon Apr 13 15:51:34.957821 2026] [:error] [pid 7228:tid 7237] [client 18.232.116.112:56415] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php%20"] [unique_id "adyghgEnn1dQrOSHHNU_qgAAAQc"], referer: https://github.com/
[Mon Apr 13 15:51:36.980936 2026] [:error] [pid 63406:tid 63418] [client 18.232.116.112:57502] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php%20"] [unique_id "adygiLHZEIkQ0Zmgp5rVnwAAAMc"], referer: https://github.com/
[Mon Apr 13 15:51:40.505466 2026] [:error] [pid 57183:tid 57196] [client 18.232.116.112:51135] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".config"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/.config"] [unique_id "adygjDDO3t8R5NaxzYSejQAAAUs"], referer: https://duckduckgo.com/
[Mon Apr 13 15:51:47.983621 2026] [:error] [pid 57183:tid 57193] [client 18.232.116.112:51135] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.htpasswd"] [unique_id "adygkzDO3t8R5NaxzYSenwAAAUg"], referer: https://www.bing.com/
[Mon Apr 13 15:51:50.768387 2026] [:error] [pid 63406:tid 63417] [client 18.232.116.112:57219] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.htpasswd."] [unique_id "adyglrHZEIkQ0Zmgp5rVwQAAAMY"], referer: https://www.google.com/
[Mon Apr 13 15:51:52.798108 2026] [:error] [pid 7228:tid 7249] [client 18.232.116.112:61769] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.htpasswd/"] [unique_id "adygmAEnn1dQrOSHHNU_zwAAARM"], referer: https://github.com/
[Mon Apr 13 15:51:54.805511 2026] [:error] [pid 63406:tid 63428] [client 18.232.116.112:52317] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.htpasswd%00"] [unique_id "adygmrHZEIkQ0Zmgp5rVywAAANE"], referer: https://www.bing.com/
[Mon Apr 13 15:51:56.778170 2026] [:error] [pid 57183:tid 57204] [client 18.232.116.112:62170] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.htpasswd%20"] [unique_id "adygnDDO3t8R5NaxzYSeuAAAAVM"], referer: https://github.com/
[Mon Apr 13 15:51:58.709217 2026] [:error] [pid 57183:tid 57194] [client 18.232.116.112:62455] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.htpasswd%20"] [unique_id "adygnjDO3t8R5NaxzYSexwAAAUk"], referer: https://www.google.com/
[Mon Apr 13 15:52:01.735342 2026] [:error] [pid 63406:tid 63417] [client 18.232.116.112:58134] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".inc"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/config.inc"] [unique_id "adygobHZEIkQ0Zmgp5rV6AAAAMY"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:52:09.166276 2026] [:error] [pid 63406:tid 63435] [client 18.232.116.112:58134] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".inc"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/db.inc"] [unique_id "adygqbHZEIkQ0Zmgp5rWGQAAANg"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:52:16.622873 2026] [:error] [pid 63406:tid 63426] [client 18.232.116.112:58134] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".inc"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/database.inc"] [unique_id "adygsLHZEIkQ0Zmgp5rWIgAAAM8"], referer: https://www.google.com/search?q=
[Mon Apr 13 15:52:23.942169 2026] [:error] [pid 63406:tid 63429] [client 18.232.116.112:58134] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".asa"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/config.asa"] [unique_id "adygt7HZEIkQ0Zmgp5rWLgAAANI"], referer: https://duckduckgo.com/
[Mon Apr 13 15:52:31.366116 2026] [:error] [pid 63406:tid 63424] [client 18.232.116.112:58134] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".asa"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/global.asa"] [unique_id "adygv7HZEIkQ0Zmgp5rWPwAAAM0"], referer: https://www.google.com/
[Mon Apr 13 15:52:41.025005 2026] [:error] [pid 63406:tid 63425] [client 18.232.116.112:58134] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/composer.json"] [unique_id "adygybHZEIkQ0Zmgp5rWZQAAAM4"], referer: https://www.bing.com/
[Mon Apr 13 15:52:43.024280 2026] [:error] [pid 63406:tid 63420] [client 18.232.116.112:51464] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/composer.json."] [unique_id "adygy7HZEIkQ0Zmgp5rWawAAAMk"], referer: https://www.bing.com/
[Mon Apr 13 15:52:45.021569 2026] [:error] [pid 63310:tid 63367] [client 18.232.116.112:61402] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/composer.json/"] [unique_id "adygzXoXpRU5ztmwPjIgAwAAAFc"], referer: https://duckduckgo.com/
[Mon Apr 13 15:52:47.023493 2026] [:error] [pid 63406:tid 63427] [client 18.232.116.112:51748] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/composer.json%00"] [unique_id "adygz7HZEIkQ0Zmgp5rWfAAAANA"], referer: https://duckduckgo.com/
[Mon Apr 13 15:52:49.025346 2026] [:error] [pid 57183:tid 57186] [client 18.232.116.112:51141] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/composer.json%20"] [unique_id "adyg0TDO3t8R5NaxzYSffgAAAUE"], referer: https://www.bing.com/
[Mon Apr 13 15:52:51.647296 2026] [:error] [pid 63406:tid 63420] [client 18.232.116.112:63921] [client 18.232.116.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/composer.json%20"] [unique_id "adyg07HZEIkQ0Zmgp5rWkQAAAMk"], referer: https://www.google.com/
[Mon Apr 13 17:24:10.862452 2026] [:error] [pid 63310:tid 63357] [client 114.80.36.40:57898] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ady2OnoXpRU5ztmwPjIxwQAAAE0"]
[Mon Apr 13 17:46:04.612165 2026] [:error] [pid 63406:tid 63420] [client 43.130.101.151:42290] [client 43.130.101.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ady7XLHZEIkQ0Zmgp5o2UQAAAMk"]
[Mon Apr 13 20:28:35.116263 2026] [:error] [pid 57183:tid 57207] [client 43.159.136.201:49866] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "adzhczDO3t8R5NaxzYQ3ygAAAVY"]
[Mon Apr 13 20:40:04.698201 2026] [:error] [pid 7228:tid 7245] [client 103.77.107.178:60707] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "adzkJAEnn1dQrOSHHNWVwgAAAQ8"]
[Mon Apr 13 23:18:08.778816 2026] [:error] [pid 63311:tid 63386] [client 212.47.78.118:61277] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad0JMKHjrGN1MqBCVFktrwAAAI8"]
[Mon Apr 13 23:18:09.365500 2026] [:error] [pid 63406:tid 63433] [client 212.47.78.118:60660] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ad0JMbHZEIkQ0Zmgp5oh-AAAANY"]
[Mon Apr 13 23:18:09.981501 2026] [:error] [pid 63406:tid 63411] [client 212.47.78.118:49337] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "ad0JMbHZEIkQ0Zmgp5oiAQAAAMA"]
[Mon Apr 13 23:18:24.667896 2026] [:error] [pid 7228:tid 7245] [client 170.106.179.68:40794] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad0JQAEnn1dQrOSHHNXKaAAAAQ8"]
[Tue Apr 14 00:07:54.583068 2026] [:error] [pid 7228:tid 7230] [client 175.6.217.4:37957] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad0U2gEnn1dQrOSHHNXX1AAAAQA"]
[Tue Apr 14 00:55:03.414152 2026] [:error] [pid 59915:tid 59983] [client 115.84.115.161:4835] [client 115.84.115.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.84.115.161, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ad0f54eTNdEemByf99gfUAAAAIw"]
[Tue Apr 14 05:43:47.478373 2026] [:error] [pid 19793:tid 19807] [client 170.106.11.6:60488] [client 170.106.11.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad1jkwGEQsZw9TkmIA4iDQAAAMw"]
[Tue Apr 14 06:54:48.498251 2026] [:error] [pid 35629:tid 35662] [client 72.146.2.255:31687] [client 72.146.2.255] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad10ODY8VahzC1YJBSimugAAAEM"]
[Tue Apr 14 06:54:58.077503 2026] [:error] [pid 35713:tid 35734] [client 72.146.2.255:36943] [client 72.146.2.255] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "ad10Qq6-hhx6ZepqOSmPZwAAANI"]
[Tue Apr 14 06:55:29.790400 2026] [:error] [pid 37226:tid 37249] [client 72.146.2.255:23268] [client 72.146.2.255] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wincust.php"] [unique_id "ad10YZOA5-IQ0IVmQCqcoAAAAVU"]
[Tue Apr 14 07:05:06.924884 2026] [:error] [pid 37226:tid 37242] [client 192.144.148.122:46770] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad12opOA5-IQ0IVmQCqh9AAAAU4"]
[Tue Apr 14 08:12:40.767150 2026] [:error] [pid 35628:tid 35643] [client 216.73.216.0:36624] [client 216.73.216.0] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||paramountestate.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/robots.txt"] [unique_id "ad2GeOfPm-ozGuwCWXKoSQAAAAs"]
[Tue Apr 14 13:15:23.633503 2026] [:error] [pid 37048:tid 37067] [client 43.163.95.253:58566] [client 43.163.95.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad3Na552Bo1OyzeXo_zc8AAAARE"]
[Tue Apr 14 13:43:56.412468 2026] [:error] [pid 35630:tid 35699] [client 216.73.216.0:20402] [client 216.73.216.0] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.paramountestate.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "ad3UHDer0pVFxOiOauUDfQAAAI0"]
[Tue Apr 14 16:35:48.954514 2026] [:error] [pid 59985:tid 60012] [client 34.85.144.184:62262] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad38ZOgHaxkvLE6V1kkknQAAABM"]
[Tue Apr 14 17:42:34.963717 2026] [:error] [pid 60074:tid 60099] [client 192.227.138.144:37414] [client 192.227.138.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad4MCutqnEmNU9vpHClBlAAAANc"], referer: https://www.google.com
[Tue Apr 14 18:54:31.009773 2026] [:error] [pid 59987:tid 60058] [client 170.106.143.6:55788] [client 170.106.143.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad4c51Wpk-Tfi6_vLKr-6gAAAIs"]
[Tue Apr 14 20:40:12.047574 2026] [:error] [pid 3778:tid 3792] [client 223.244.35.77:59744] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad41rBx5DfpNmYF_PaHb4AAAAUw"]
[Wed Apr 15 00:21:40.689194 2026] [:error] [pid 59985:tid 60003] [client 49.51.203.164:36640] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad5plOgHaxkvLE6V1kmGhgAAAAo"]
[Wed Apr 15 00:24:27.487009 2026] [:error] [pid 3810:tid 3821] [client 20.151.227.112:23186] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "ad5qO8qc5XaYZhFXVGf4qwAAAYg"]
[Wed Apr 15 00:24:30.485531 2026] [:error] [pid 59986:tid 60035] [client 20.151.227.112:23228] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "ad5qPp6axKeW6bX4H7foRAAAAE8"]
[Wed Apr 15 00:24:32.203018 2026] [:error] [pid 3810:tid 3816] [client 20.151.227.112:23213] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "ad5qQMqc5XaYZhFXVGf4twAAAYM"]
[Wed Apr 15 00:24:40.635697 2026] [:error] [pid 59986:tid 60042] [client 20.151.227.112:23057] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/doo.php"] [unique_id "ad5qSJ6axKeW6bX4H7foZwAAAFY"]
[Wed Apr 15 00:24:44.070537 2026] [:error] [pid 3810:tid 3819] [client 20.151.227.112:23196] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x123.php"] [unique_id "ad5qTMqc5XaYZhFXVGf42wAAAYY"]
[Wed Apr 15 00:24:45.013712 2026] [:error] [pid 3778:tid 3785] [client 20.151.227.112:23183] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x123.php"] [unique_id "ad5qTRx5DfpNmYF_PaEg1wAAAUU"]
[Wed Apr 15 00:24:46.421112 2026] [:error] [pid 60074:tid 60079] [client 20.151.227.112:23210] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x123.php"] [unique_id "ad5qTutqnEmNU9vpHCnpaAAAAMM"]
[Wed Apr 15 00:24:48.874414 2026] [:error] [pid 59985:tid 60001] [client 20.151.227.112:23041] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x123.php"] [unique_id "ad5qUOgHaxkvLE6V1kmG9wAAAAg"]
[Wed Apr 15 00:24:50.025163 2026] [:error] [pid 59986:tid 60032] [client 20.151.227.112:23191] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "ad5qUp6axKeW6bX4H7forAAAAEw"]
[Wed Apr 15 00:24:51.106196 2026] [:error] [pid 59986:tid 60043] [client 20.151.227.112:23173] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "ad5qU56axKeW6bX4H7fotAAAAFc"]
[Wed Apr 15 00:24:59.089963 2026] [:error] [pid 60074:tid 60080] [client 20.151.227.112:23202] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "ad5qW-tqnEmNU9vpHCnpewAAAMQ"]
[Wed Apr 15 00:25:01.089200 2026] [:error] [pid 3810:tid 3826] [client 20.151.227.112:23221] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/h2.php"] [unique_id "ad5qXcqc5XaYZhFXVGf45gAAAY0"]
[Wed Apr 15 00:25:02.353123 2026] [:error] [pid 22177:tid 22195] [client 20.151.227.112:23053] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/greateb.php"] [unique_id "ad5qXoTVeJSXHDIlEDuvzgAAARA"]
[Wed Apr 15 00:25:10.359347 2026] [:error] [pid 3778:tid 3802] [client 20.151.227.112:23203] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/greateb.php"] [unique_id "ad5qZhx5DfpNmYF_PaEg-wAAAVY"]
[Wed Apr 15 00:25:11.553058 2026] [:error] [pid 3810:tid 3832] [client 20.151.227.112:23226] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/greateb.php"] [unique_id "ad5qZ8qc5XaYZhFXVGf4-QAAAZM"]
[Wed Apr 15 00:25:13.721770 2026] [:error] [pid 3810:tid 3817] [client 20.151.227.112:23174] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/greateb.php"] [unique_id "ad5qacqc5XaYZhFXVGf5BwAAAYQ"]
[Wed Apr 15 00:25:16.622887 2026] [:error] [pid 3778:tid 3787] [client 20.151.227.112:23044] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "ad5qbBx5DfpNmYF_PaEhCwAAAUc"]
[Wed Apr 15 00:25:18.054746 2026] [:error] [pid 3778:tid 3792] [client 20.151.227.112:23051] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "ad5qbhx5DfpNmYF_PaEhDgAAAUw"]
[Wed Apr 15 00:25:19.138303 2026] [:error] [pid 60074:tid 60077] [client 20.151.227.112:23179] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "ad5qb-tqnEmNU9vpHCnpmgAAAME"]
[Wed Apr 15 00:25:20.716751 2026] [:error] [pid 3810:tid 3832] [client 20.151.227.112:23208] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-class.php"] [unique_id "ad5qcMqc5XaYZhFXVGf5FgAAAZM"]
[Wed Apr 15 00:25:21.556999 2026] [:error] [pid 3810:tid 3837] [client 20.151.227.112:23171] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mjq.php/kma.php"] [unique_id "ad5qccqc5XaYZhFXVGf5GgAAAZg"]
[Wed Apr 15 00:26:11.312731 2026] [:error] [pid 3810:tid 3831] [client 20.151.227.112:23230] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/de.php"] [unique_id "ad5qo8qc5XaYZhFXVGf6FwAAAZI"]
[Wed Apr 15 00:26:12.116649 2026] [:error] [pid 59986:tid 60036] [client 20.151.227.112:23059] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/de.php"] [unique_id "ad5qpJ6axKeW6bX4H7fpmQAAAFA"]
[Wed Apr 15 00:26:12.609272 2026] [:error] [pid 59986:tid 60024] [client 20.151.227.112:23182] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/de.php"] [unique_id "ad5qpJ6axKeW6bX4H7fpnQAAAEQ"]
[Wed Apr 15 00:26:14.313947 2026] [:error] [pid 3778:tid 3790] [client 20.151.227.112:23061] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/de.php"] [unique_id "ad5qphx5DfpNmYF_PaEhSwAAAUo"]
[Wed Apr 15 00:26:14.928005 2026] [:error] [pid 59985:tid 60003] [client 20.151.227.112:23077] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs6.php"] [unique_id "ad5qpugHaxkvLE6V1kmHigAAAAo"]
[Wed Apr 15 00:26:15.582325 2026] [:error] [pid 60074:tid 60099] [client 20.151.227.112:23193] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs6.php"] [unique_id "ad5qp-tqnEmNU9vpHCnp5gAAANc"]
[Wed Apr 15 00:26:17.120490 2026] [:error] [pid 22177:tid 22187] [client 20.151.227.112:23066] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs6.php"] [unique_id "ad5qqYTVeJSXHDIlEDuwGgAAAQg"]
[Wed Apr 15 00:26:18.334187 2026] [:error] [pid 60074:tid 60078] [client 20.151.227.112:23215] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fs6.php"] [unique_id "ad5qqutqnEmNU9vpHCnp7gAAAMI"]
[Wed Apr 15 00:26:20.135307 2026] [:error] [pid 59986:tid 60040] [client 20.151.227.112:23220] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "ad5qrJ6axKeW6bX4H7fpwwAAAFQ"]
[Wed Apr 15 00:26:22.418433 2026] [:error] [pid 60074:tid 60091] [client 20.151.227.112:23177] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "ad5qrutqnEmNU9vpHCnp9wAAAM8"]
[Wed Apr 15 00:26:24.389641 2026] [:error] [pid 59985:tid 60012] [client 20.151.227.112:23040] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "ad5qsOgHaxkvLE6V1kmHjQAAABM"]
[Wed Apr 15 00:26:25.986193 2026] [:error] [pid 59986:tid 60039] [client 20.151.227.112:23199] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ng.php"] [unique_id "ad5qsZ6axKeW6bX4H7fp2QAAAFM"]
[Wed Apr 15 00:26:27.130559 2026] [:error] [pid 59986:tid 60036] [client 20.151.227.112:23064] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/btx25.php"] [unique_id "ad5qs56axKeW6bX4H7fp4QAAAFA"]
[Wed Apr 15 00:26:28.325093 2026] [:error] [pid 59986:tid 60032] [client 20.151.227.112:23065] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/btx25.php"] [unique_id "ad5qtJ6axKeW6bX4H7fp5gAAAEw"]
[Wed Apr 15 00:26:29.412756 2026] [:error] [pid 59985:tid 60013] [client 20.151.227.112:23214] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/btx25.php"] [unique_id "ad5qtegHaxkvLE6V1kmHkAAAABQ"]
[Wed Apr 15 00:26:30.174343 2026] [:error] [pid 3778:tid 3784] [client 20.151.227.112:23185] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/btx25.php"] [unique_id "ad5qthx5DfpNmYF_PaEhWAAAAUQ"]
[Wed Apr 15 00:26:31.481891 2026] [:error] [pid 60074:tid 60096] [client 20.151.227.112:23219] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dass.php"] [unique_id "ad5qt-tqnEmNU9vpHCnp_wAAANQ"]
[Wed Apr 15 00:26:33.236691 2026] [:error] [pid 60074:tid 60095] [client 20.151.227.112:23222] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dass.php"] [unique_id "ad5quetqnEmNU9vpHCnqCgAAANM"]
[Wed Apr 15 00:26:34.081149 2026] [:error] [pid 59987:tid 60048] [client 20.151.227.112:23080] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dass.php"] [unique_id "ad5qulWpk-Tfi6_vLKpkqgAAAIE"]
[Wed Apr 15 00:26:34.814676 2026] [:error] [pid 3778:tid 3783] [client 20.151.227.112:23211] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dass.php"] [unique_id "ad5quhx5DfpNmYF_PaEhXQAAAUM"]
[Wed Apr 15 00:26:44.067732 2026] [:error] [pid 59986:tid 60036] [client 20.151.227.112:23231] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/co.php"] [unique_id "ad5qxJ6axKeW6bX4H7fp9wAAAFA"]
[Wed Apr 15 00:26:54.445153 2026] [:error] [pid 59987:tid 60069] [client 20.151.227.112:23172] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/obfuscate.php"] [unique_id "ad5qzlWpk-Tfi6_vLKpktQAAAJY"]
[Wed Apr 15 00:26:55.617426 2026] [:error] [pid 60074:tid 60083] [client 20.151.227.112:23189] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/obfuscate.php"] [unique_id "ad5qz-tqnEmNU9vpHCnqJwAAAMc"]
[Wed Apr 15 00:26:56.960173 2026] [:error] [pid 3778:tid 3793] [client 20.151.227.112:23229] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/obfuscate.php"] [unique_id "ad5q0Bx5DfpNmYF_PaEhegAAAU0"]
[Wed Apr 15 00:26:58.765442 2026] [:error] [pid 59986:tid 60040] [client 20.151.227.112:23055] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/obfuscate.php"] [unique_id "ad5q0p6axKeW6bX4H7fqEAAAAFQ"]
[Wed Apr 15 00:27:01.065977 2026] [:error] [pid 59987:tid 60063] [client 20.151.227.112:23178] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ww.php"] [unique_id "ad5q1VWpk-Tfi6_vLKpkuwAAAJA"]
[Wed Apr 15 01:20:23.880012 2026] [:error] [pid 17866:tid 17876] [client 216.81.248.211:55568] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "ad53V7x_17kv70EUVIlHVAAAAYg"]
[Wed Apr 15 03:37:38.051137 2026] [:error] [pid 64398:tid 64423] [client 162.62.231.139:59102] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad6XgoikdzJ_p6U7WLK7TgAAANc"]
[Wed Apr 15 06:42:08.443960 2026] [:error] [pid 45504:tid 45523] [client 170.106.113.159:58064] [client 170.106.113.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad7CwK3iO9_fE_IQEMlcdwAAARE"]
[Wed Apr 15 09:32:19.273553 2026] [:error] [pid 30644:tid 30657] [client 182.42.105.144:53355] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad7qo68vuyJ0N41zsM__7QAAAMc"]
[Wed Apr 15 11:14:08.648529 2026] [:error] [pid 30644:tid 30667] [client 103.237.39.208:23978] [client 103.237.39.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.237.39.208, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ad8CgK8vuyJ0N41zsM8ZoQAAANE"]
[Wed Apr 15 12:59:53.936588 2026] [:error] [pid 51333:tid 51359] [client 43.156.204.134:43856] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad8bSQVKCWn27HqShP3BeAAAABU"]
[Wed Apr 15 13:49:57.240036 2026] [:error] [pid 12433:tid 12442] [client 193.37.33.231:32103] [client 193.37.33.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.231, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ad8nBbwxDHWF005pP_5qmgAAAQc"]
[Wed Apr 15 16:01:26.838659 2026] [:error] [pid 12433:tid 12451] [client 203.2.64.59:46054] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ad9F1rwxDHWF005pP_6uxgAAARA"]
[Wed Apr 15 21:58:43.118826 2026] [:error] [pid 31053:tid 31077] [client 172.161.107.89:38777] [client 172.161.107.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "ad-ZkxcEkLCmvF0fjDcW-gAAAJU"]
[Wed Apr 15 22:00:38.412926 2026] [:error] [pid 30957:tid 30998] [client 170.106.110.146:52172] [client 170.106.110.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ad-aBn5gwVEVXHfVSiqvEQAAAEk"]
[Wed Apr 15 23:27:34.366589 2026] [:error] [pid 37370:tid 37394] [client 4.232.83.105:2036] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-uZng-gnM2Ga0cGACnpwAAARY"]
[Wed Apr 15 23:27:34.832937 2026] [:error] [pid 30958:tid 31030] [client 4.232.83.105:2046] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-uZseG3wSKTO7NWFHr7wAAAM4"]
[Wed Apr 15 23:27:35.299392 2026] [:error] [pid 23913:tid 23926] [client 4.232.83.105:2010] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-uZ1UaK3MLdSaLOyjdnAAAAUs"]
[Wed Apr 15 23:27:35.768537 2026] [:error] [pid 23913:tid 23937] [client 4.232.83.105:2033] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-uZ1UaK3MLdSaLOyjdnQAAAVY"]
[Thu Apr 16 00:42:55.914429 2026] [ssl:error] [pid 23913:tid 23925] [client 47.128.112.39:21750] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Thu Apr 16 01:04:39.207150 2026] [:error] [pid 16664:tid 16734] [client 189.135.223.140:54987] [client 189.135.223.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.135.223.140, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ad_FJzdzt684awDJwRTdiQAAAY8"]
[Thu Apr 16 01:17:24.433600 2026] [authz_core:error] [pid 37370:tid 37382] [client 68.183.180.73:47570] AH01630: client denied by server configuration: /home/paramount/public_html/server-status
[Thu Apr 16 01:17:29.409740 2026] [:error] [pid 16664:tid 16742] [client 68.183.180.73:41244] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "ad_IKTdzt684awDJwRTnwQAAAZc"]
[Thu Apr 16 01:17:33.410614 2026] [:error] [pid 30956:tid 30982] [client 68.183.180.73:41258] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "ad_ILUBGUpjaWntNYq27iAAAABY"]
[Thu Apr 16 03:36:01.870934 2026] [:error] [pid 54651:tid 54732] [client 135.232.224.82:54348] [client 135.232.224.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "ad_ooWr-aGmBfIUdvtU3BAAAAZA"]
[Thu Apr 16 07:44:05.151322 2026] [:error] [pid 29603:tid 29623] [client 101.33.80.42:57016] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeAixVfGOR6fpTWUAzrn-QAAARI"]
[Thu Apr 16 10:35:26.445201 2026] [:error] [pid 57537:tid 57585] [client 192.144.148.122:44736] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeBK7lVQRS8nm73ENAljKQAAAEo"]
[Thu Apr 16 12:27:50.833651 2026] [:error] [pid 57538:tid 57608] [client 137.184.61.119:57816] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeBlRsuMaiEF5SVR2BeGjwAAAIY"]
[Thu Apr 16 12:27:52.444845 2026] [:error] [pid 7880:tid 7909] [client 137.184.61.119:33500] [client 137.184.61.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeBlSKaezm4fSGc0yUIWQQAAAZg"]
[Thu Apr 16 12:34:18.699959 2026] [:error] [pid 57639:tid 57648] [client 98.93.160.221:45772] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aeBmyqMCQoTw7TsxWuluyQAAAMI"]
[Thu Apr 16 14:01:51.316409 2026] [:error] [pid 29603:tid 29620] [client 98.93.160.221:60240] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeB7T1fGOR6fpTWUAzo-XQAAAQ8"]
[Thu Apr 16 18:23:34.732608 2026] [:error] [pid 7880:tid 7904] [client 43.133.69.37:39196] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeC4pqaezm4fSGc0yUJtxAAAAZM"]
[Thu Apr 16 18:46:46.743250 2026] [:error] [pid 57639:tid 57667] [client 162.243.166.74:38620] [client 162.243.166.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeC-FqMCQoTw7TsxWukulAAAANU"]
[Thu Apr 16 19:20:45.499123 2026] [:error] [pid 57536:tid 57553] [client 20.166.31.184:15746] [client 20.166.31.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeDGDSQU4faGja6jpDtJpQAAAAU"]
[Thu Apr 16 20:29:16.166471 2026] [:error] [pid 57639:tid 57649] [client 165.227.4.237:63839] [client 165.227.4.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.4.237, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aeDWHKMCQoTw7TsxWumAfAAAAMM"]
[Thu Apr 16 20:29:16.848885 2026] [:error] [pid 57538:tid 57622] [client 165.227.4.237:64290] [client 165.227.4.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.4.237, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aeDWHMuMaiEF5SVR2BfXjAAAAJQ"]
[Thu Apr 16 23:10:54.401482 2026] [:error] [pid 57639:tid 57660] [client 45.130.203.167:38891] [client 45.130.203.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/HEAD"] [unique_id "aeD7_qMCQoTw7TsxWukJFwAAAM4"]
[Fri Apr 17 00:48:09.246440 2026] [:error] [pid 43385:tid 43404] [client 4.232.179.255:29093] [client 4.232.179.255] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aeESycnIxkJaUI8KNs73wwAAAA8"]
[Fri Apr 17 03:15:01.788014 2026] [:error] [pid 43387:tid 43477] [client 195.178.110.33:42482] [client 195.178.110.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeE1NSBNsONqHxWTakVnYAAAAJg"]
[Fri Apr 17 03:15:08.843964 2026] [:error] [pid 43387:tid 43474] [client 195.178.110.33:42494] [client 195.178.110.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.svn/entries"] [unique_id "aeE1PCBNsONqHxWTakVnhAAAAJU"]
[Fri Apr 17 04:02:01.885151 2026] [:error] [pid 9263:tid 9278] [client 209.38.89.62:50128] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/install.php"] [unique_id "aeFAORP68VyHNvj1e56MWwAAAM0"]
[Fri Apr 17 04:02:02.395878 2026] [:error] [pid 9152:tid 9212] [client 209.38.89.62:50138] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp/wp-admin/install.php"] [unique_id "aeFAOpJYca8I3TNCwIfMkQAAAFY"]
[Fri Apr 17 04:02:02.671020 2026] [:error] [pid 9152:tid 9190] [client 209.38.89.62:50142] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/new/wp-admin/install.php"] [unique_id "aeFAOpJYca8I3TNCwIfMkwAAAEA"]
[Fri Apr 17 04:02:02.962548 2026] [:error] [pid 9263:tid 9289] [client 209.38.89.62:50146] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/old/wp-admin/install.php"] [unique_id "aeFAOhP68VyHNvj1e56MYQAAANg"]
[Fri Apr 17 04:02:03.099817 2026] [:error] [pid 9263:tid 9281] [client 209.38.89.62:50160] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wordpress/wp-admin/install.php"] [unique_id "aeFAOxP68VyHNvj1e56MYwAAANA"]
[Fri Apr 17 04:02:03.293491 2026] [:error] [pid 9153:tid 9235] [client 209.38.89.62:50168] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test/wp-admin/install.php"] [unique_id "aeFAO-MHGxkTZX3c45ethwAAAJE"]
[Fri Apr 17 04:02:03.551315 2026] [:error] [pid 9263:tid 9273] [client 209.38.89.62:50170] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blog/wp-admin/install.php"] [unique_id "aeFAOxP68VyHNvj1e56MZwAAAMg"]
[Fri Apr 17 04:02:03.675262 2026] [:error] [pid 9153:tid 9229] [client 209.38.89.62:50186] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cms/wp-admin/install.php"] [unique_id "aeFAO-MHGxkTZX3c45etiAAAAIs"]
[Fri Apr 17 04:02:03.813991 2026] [:error] [pid 9151:tid 9180] [client 209.38.89.62:50190] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/web/wp-admin/install.php"] [unique_id "aeFAO8hTVuRPkua22vRhyAAAABM"]
[Fri Apr 17 04:02:03.952473 2026] [:error] [pid 9153:tid 9241] [client 209.38.89.62:50198] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/backup/wp-admin/install.php"] [unique_id "aeFAO-MHGxkTZX3c45etiQAAAJc"]
[Fri Apr 17 04:02:04.171433 2026] [:error] [pid 9151:tid 9165] [client 209.38.89.62:50202] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/site/wp-admin/install.php"] [unique_id "aeFAPMhTVuRPkua22vRhygAAAAQ"]
[Fri Apr 17 04:02:04.543794 2026] [:error] [pid 9263:tid 9278] [client 209.38.89.62:50214] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/oldsite/wp-admin/install.php"] [unique_id "aeFAPBP68VyHNvj1e56MbQAAAM0"]
[Fri Apr 17 04:02:04.693396 2026] [:error] [pid 9263:tid 9280] [client 209.38.89.62:54106] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shop/wp-admin/install.php"] [unique_id "aeFAPBP68VyHNvj1e56MbgAAAM8"]
[Fri Apr 17 05:41:11.053958 2026] [:error] [pid 9152:tid 9208] [client 125.75.66.97:34033] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeFXd5JYca8I3TNCwIcN2QAAAFI"]
[Fri Apr 17 07:04:07.937421 2026] [:error] [pid 9263:tid 9275] [client 136.117.100.166:57324] [client 136.117.100.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/config/.env"] [unique_id "aeFq5xP68VyHNvj1e549bQAAAMo"]
[Fri Apr 17 07:36:50.885622 2026] [:error] [pid 25010:tid 25013] [client 43.130.91.95:55710] [client 43.130.91.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeFyko-7kkf42RarqQ3snQAAAUA"]
[Fri Apr 17 10:37:17.140069 2026] [ssl:error] [pid 25010:tid 25023] [client 185.156.46.161:54080] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: http://paramountestate.com/
[Fri Apr 17 11:56:15.451018 2026] [:error] [pid 9263:tid 9280] [client 43.140.247.223:60562] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeGvXxP68VyHNvj1e55wvwAAAM8"]
[Fri Apr 17 13:19:08.446383 2026] [:error] [pid 9152:tid 9213] [client 101.33.81.73:59638] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeHCzJJYca8I3TNCwIft8QAAAFc"]
[Fri Apr 17 18:25:44.875422 2026] [:error] [pid 9151:tid 9184] [client 223.244.35.77:60888] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeIKqMhTVuRPkua22vQshwAAABc"]
[Fri Apr 17 20:47:09.754879 2026] [:error] [pid 9152:tid 9194] [client 51.103.162.82:21778] [client 51.103.162.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeIrzZJYca8I3TNCwIdb1AAAAEQ"]
[Fri Apr 17 22:57:25.722413 2026] [:error] [pid 9153:tid 9237] [client 43.159.145.149:41168] [client 43.159.145.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeJKVeMHGxkTZX3c45chKwAAAJM"]
[Sat Apr 18 00:56:12.391736 2026] [:error] [pid 42442:tid 42460] [client 221.229.106.25:51848] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeJmLD4PBGqL_yqPJ8kZYgAAARA"]
[Sat Apr 18 02:16:23.254067 2026] [:error] [pid 59042:tid 59049] [client 101.33.66.34:40852] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeJ4956p5oql0UklEBJgHwAAAAI"]
[Sat Apr 18 07:06:01.740116 2026] [:error] [pid 13023:tid 13029] [client 203.2.64.59:59446] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeK82f1e7hG8DAeABB8ZVAAAAQQ"]
[Sat Apr 18 07:30:27.521126 2026] [:error] [pid 9970:tid 9980] [client 43.167.239.66:59216] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeLCkyYdRLRhVmaIMx33fQAAAMY"]
[Sat Apr 18 09:27:16.889561 2026] [:error] [pid 9865:tid 9961] [client 20.166.51.62:34900] [client 20.166.51.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aeLd9Kzb5knECIY-C-jqUAAAAJg"]
[Sat Apr 18 09:59:13.693865 2026] [:error] [pid 13023:tid 13049] [client 85.203.15.4:29257] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeLlcf1e7hG8DAeABB9nOgAAARg"]
[Sat Apr 18 09:59:15.299862 2026] [:error] [pid 9970:tid 9987] [client 81.199.26.78:28973] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeLlcyYdRLRhVmaIMx0e9wAAAM0"]
[Sat Apr 18 09:59:17.903464 2026] [:error] [pid 13023:tid 13035] [client 85.203.15.4:34727] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aeLldf1e7hG8DAeABB9nVAAAAQo"]
[Sat Apr 18 09:59:19.538060 2026] [:error] [pid 9863:tid 9885] [client 81.199.26.71:52777] [client 81.199.26.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "aeLldzjjiypiFrTucbJHmgAAAAw"]
[Sat Apr 18 09:59:22.236079 2026] [:error] [pid 9865:tid 9951] [client 81.199.26.74:44301] [client 81.199.26.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeLleqzb5knECIY-C-j0YAAAAI4"]
[Sat Apr 18 09:59:23.207054 2026] [:error] [pid 9970:tid 9995] [client 85.203.15.242:26517] [client 85.203.15.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeLleyYdRLRhVmaIMx0fAgAAANU"]
[Sat Apr 18 09:59:23.859224 2026] [:error] [pid 34290:tid 34342] [client 81.199.26.82:35087] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeLlexqX6WpmmAXOBi-IhQAAAdc"]
[Sat Apr 18 09:59:24.505164 2026] [:error] [pid 9864:tid 9906] [client 81.199.26.81:57143] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeLlfICFeowknfXHM7lpdwAAAEE"]
[Sat Apr 18 09:59:25.147335 2026] [:error] [pid 34237:tid 34258] [client 85.203.15.38:35701] [client 85.203.15.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeLlfRBmX4Wq5a6rxfYQCQAAAVM"]
[Sat Apr 18 09:59:25.788056 2026] [:error] [pid 34288:tid 34312] [client 81.199.26.82:34913] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeLlfeTIiy__PtiLmplsRQAAAZQ"]
[Sat Apr 18 09:59:26.793027 2026] [:error] [pid 34237:tid 34249] [client 85.203.15.238:24287] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeLlfhBmX4Wq5a6rxfYQDQAAAUo"]
[Sat Apr 18 09:59:28.084839 2026] [:error] [pid 34288:tid 34297] [client 81.199.26.72:23541] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "aeLlgOTIiy__PtiLmplsTQAAAYU"]
[Sat Apr 18 09:59:29.363996 2026] [:error] [pid 34288:tid 34303] [client 81.199.26.79:33323] [client 81.199.26.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aeLlgeTIiy__PtiLmplsVgAAAYs"]
[Sat Apr 18 09:59:30.340878 2026] [:error] [pid 9864:tid 9914] [client 85.203.15.16:62733] [client 85.203.15.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aeLlgoCFeowknfXHM7lpfgAAAEg"]
[Sat Apr 18 09:59:31.318601 2026] [:error] [pid 9970:tid 9991] [client 85.203.15.33:24137] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aeLlgyYdRLRhVmaIMx0fFgAAANE"]
[Sat Apr 18 09:59:33.909584 2026] [:error] [pid 13023:tid 13038] [client 85.203.15.33:39023] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aeLlhf1e7hG8DAeABB9nigAAAQ0"]
[Sat Apr 18 09:59:34.876824 2026] [:error] [pid 34237:tid 34241] [client 81.199.26.77:40593] [client 81.199.26.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aeLlhhBmX4Wq5a6rxfYQGAAAAUI"]
[Sat Apr 18 09:59:36.166947 2026] [:error] [pid 34290:tid 34335] [client 81.199.26.78:26851] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "aeLliBqX6WpmmAXOBi-IlQAAAdA"]
[Sat Apr 18 09:59:37.152717 2026] [:error] [pid 9863:tid 9884] [client 85.203.15.39:57049] [client 85.203.15.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aeLliTjjiypiFrTucbJHwQAAAAs"]
[Sat Apr 18 09:59:39.073641 2026] [:error] [pid 9863:tid 9885] [client 81.199.26.81:41151] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aeLlizjjiypiFrTucbJH0AAAAAw"]
[Sat Apr 18 09:59:40.042680 2026] [:error] [pid 34290:tid 34337] [client 85.203.15.245:48301] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aeLljBqX6WpmmAXOBi-ImAAAAdI"]
[Sat Apr 18 09:59:41.020122 2026] [:error] [pid 9970:tid 9979] [client 85.203.15.31:23101] [client 85.203.15.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aeLljSYdRLRhVmaIMx0fHgAAAMU"]
[Sat Apr 18 09:59:41.671424 2026] [:error] [pid 13023:tid 13043] [client 81.199.26.71:39945] [client 81.199.26.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aeLljf1e7hG8DAeABB9nmgAAARI"]
[Sat Apr 18 09:59:42.315228 2026] [:error] [pid 13023:tid 13040] [client 85.203.15.236:60705] [client 85.203.15.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aeLljv1e7hG8DAeABB9noAAAAQ8"]
[Sat Apr 18 09:59:43.946488 2026] [:error] [pid 13023:tid 13039] [client 85.203.15.26:20291] [client 85.203.15.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aeLlj_1e7hG8DAeABB9nrgAAAQ4"]
[Sat Apr 18 09:59:44.592790 2026] [:error] [pid 9863:tid 9887] [client 85.203.15.238:56015] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class.api.php"] [unique_id "aeLlkDjjiypiFrTucbJH6gAAAA4"]
[Sat Apr 18 09:59:45.236020 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.11:35417] [client 85.203.15.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aeLlkf1e7hG8DAeABB9nsgAAAQw"]
[Sat Apr 18 09:59:48.513078 2026] [:error] [pid 34288:tid 34303] [client 85.203.15.21:30579] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/admin.php"] [unique_id "aeLllOTIiy__PtiLmplsbgAAAYs"]
[Sat Apr 18 09:59:50.134667 2026] [:error] [pid 34290:tid 34337] [client 81.199.26.78:24279] [client 81.199.26.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.199.26.78, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aeLllhqX6WpmmAXOBi-IpAAAAdI"]
[Sat Apr 18 09:59:54.031006 2026] [:error] [pid 34290:tid 34340] [client 81.199.26.78:24279] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aeLlmhqX6WpmmAXOBi-ItAAAAdU"]
[Sat Apr 18 09:59:55.365816 2026] [:error] [pid 34288:tid 34301] [client 85.203.15.26:56839] [client 85.203.15.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.26, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aeLlm-TIiy__PtiLmplsfQAAAYk"]
[Sat Apr 18 09:59:56.024283 2026] [:error] [pid 34288:tid 34293] [client 85.203.15.26:56839] [client 85.203.15.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/item.php"] [unique_id "aeLlnOTIiy__PtiLmplsfwAAAYE"]
[Sat Apr 18 09:59:59.233189 2026] [:error] [pid 9970:tid 9998] [client 85.203.15.31:39747] [client 85.203.15.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aeLlnyYdRLRhVmaIMx0fQgAAANg"]
[Sat Apr 18 10:00:03.121663 2026] [:error] [pid 13023:tid 13040] [client 81.199.26.83:63611] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeLlo_1e7hG8DAeABB9n1gAAAQ8"]
[Sat Apr 18 10:00:04.675429 2026] [:error] [pid 9865:tid 9946] [client 85.203.15.25:56425] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeLlpKzb5knECIY-C-j0jgAAAIk"]
[Sat Apr 18 10:00:06.388539 2026] [:error] [pid 13023:tid 13040] [client 85.203.15.238:22005] [client 85.203.15.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.238, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aeLlpv1e7hG8DAeABB9n4QAAAQ8"]
[Sat Apr 18 10:00:06.724660 2026] [:error] [pid 13023:tid 13049] [client 85.203.15.238:22005] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeLlpv1e7hG8DAeABB9n4wAAARg"]
[Sat Apr 18 10:00:13.125907 2026] [:error] [pid 13023:tid 13049] [client 81.199.26.80:52063] [client 81.199.26.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeLlrf1e7hG8DAeABB9oIQAAARg"]
[Sat Apr 18 10:00:14.729922 2026] [:error] [pid 9863:tid 9885] [client 85.203.15.36:29433] [client 85.203.15.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.36, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeLlrjjjiypiFrTucbJIKgAAAAw"]
[Sat Apr 18 10:00:16.028201 2026] [:error] [pid 9863:tid 9879] [client 85.203.15.36:29433] [client 85.203.15.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aeLlsDjjiypiFrTucbJILwAAAAY"]
[Sat Apr 18 10:00:16.998973 2026] [:error] [pid 13023:tid 13048] [client 81.199.26.85:21705] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/infi.php"] [unique_id "aeLlsP1e7hG8DAeABB9oNgAAARc"]
[Sat Apr 18 10:00:18.278120 2026] [:error] [pid 13023:tid 13028] [client 85.203.15.16:26267] [client 85.203.15.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeLlsv1e7hG8DAeABB9oQQAAAQM"]
[Sat Apr 18 10:00:19.903646 2026] [:error] [pid 34237:tid 34254] [client 81.199.26.84:47901] [client 81.199.26.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeLlsxBmX4Wq5a6rxfYQSwAAAU8"]
[Sat Apr 18 10:00:20.546208 2026] [:error] [pid 34237:tid 34241] [client 85.203.15.10:47743] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeLltBBmX4Wq5a6rxfYQUQAAAUI"]
[Sat Apr 18 10:00:22.847881 2026] [:error] [pid 9863:tid 9892] [client 85.203.15.233:63171] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeLltjjjiypiFrTucbJIPwAAABM"]
[Sat Apr 18 10:00:23.899119 2026] [:error] [pid 9865:tid 9937] [client 85.203.15.4:23985] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeLlt6zb5knECIY-C-j0lwAAAIA"]
[Sat Apr 18 10:00:25.534053 2026] [:error] [pid 13023:tid 13027] [client 81.199.26.75:39933] [client 81.199.26.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit.php"] [unique_id "aeLluf1e7hG8DAeABB9oWAAAAQI"]
[Sat Apr 18 10:00:27.150281 2026] [:error] [pid 13023:tid 13043] [client 85.203.15.236:24745] [client 85.203.15.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeLlu_1e7hG8DAeABB9oYQAAARI"]
[Sat Apr 18 10:00:28.432439 2026] [:error] [pid 34237:tid 34242] [client 85.203.15.237:54429] [client 85.203.15.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/click.php"] [unique_id "aeLlvBBmX4Wq5a6rxfYQWwAAAUM"]
[Sat Apr 18 10:00:30.048581 2026] [:error] [pid 9863:tid 9888] [client 81.199.26.71:21103] [client 81.199.26.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeLlvjjjiypiFrTucbJIVQAAAA8"]
[Sat Apr 18 10:00:32.981146 2026] [:error] [pid 13023:tid 13026] [client 85.203.15.17:48583] [client 85.203.15.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeLlwP1e7hG8DAeABB9opgAAAQE"]
[Sat Apr 18 10:00:34.711127 2026] [:error] [pid 34288:tid 34292] [client 81.199.26.80:30947] [client 81.199.26.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aeLlwuTIiy__PtiLmplslAAAAYA"]
[Sat Apr 18 10:00:35.350375 2026] [:error] [pid 34237:tid 34244] [client 81.199.26.73:41643] [client 81.199.26.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aeLlwxBmX4Wq5a6rxfYQZgAAAUU"]
[Sat Apr 18 10:00:35.984226 2026] [:error] [pid 34237:tid 34243] [client 85.203.15.15:58765] [client 85.203.15.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aeLlwxBmX4Wq5a6rxfYQaAAAAUQ"]
[Sat Apr 18 10:00:36.974851 2026] [:error] [pid 34237:tid 34241] [client 85.203.15.236:28145] [client 85.203.15.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aeLlxBBmX4Wq5a6rxfYQbwAAAUI"]
[Sat Apr 18 10:00:37.619140 2026] [:error] [pid 13023:tid 13031] [client 81.199.26.83:53321] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aeLlxf1e7hG8DAeABB9osQAAAQY"]
[Sat Apr 18 10:00:38.919714 2026] [:error] [pid 34290:tid 34335] [client 85.203.15.31:62123] [client 85.203.15.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeLlxhqX6WpmmAXOBi-I0AAAAdA"]
[Sat Apr 18 10:00:39.567095 2026] [:error] [pid 13023:tid 13037] [client 81.199.26.80:26545] [client 81.199.26.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aeLlx_1e7hG8DAeABB9otgAAAQw"]
[Sat Apr 18 10:00:40.213174 2026] [:error] [pid 34288:tid 34315] [client 81.199.26.72:56047] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aeLlyOTIiy__PtiLmplsrQAAAZc"]
[Sat Apr 18 10:00:40.855754 2026] [:error] [pid 9865:tid 9940] [client 81.199.26.83:50209] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aeLlyKzb5knECIY-C-j0sAAAAIM"]
[Sat Apr 18 10:00:41.824168 2026] [:error] [pid 34290:tid 34332] [client 81.199.26.72:24915] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aeLlyRqX6WpmmAXOBi-I0gAAAc0"]
[Sat Apr 18 10:00:43.111901 2026] [:error] [pid 9863:tid 9874] [client 81.199.26.81:35329] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aeLlyzjjiypiFrTucbJIeQAAAAE"]
[Sat Apr 18 10:00:45.059005 2026] [:error] [pid 9863:tid 9895] [client 85.203.15.9:42979] [client 85.203.15.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aeLlzTjjiypiFrTucbJIjgAAABY"]
[Sat Apr 18 10:00:48.000962 2026] [:error] [pid 9863:tid 9891] [client 81.199.26.76:22525] [client 81.199.26.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aeLlzzjjiypiFrTucbJInAAAABI"]
[Sat Apr 18 10:00:49.618328 2026] [:error] [pid 13023:tid 13046] [client 85.203.15.16:47447] [client 85.203.15.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aeLl0f1e7hG8DAeABB9ozwAAARU"]
[Sat Apr 18 10:00:50.260672 2026] [:error] [pid 13023:tid 13038] [client 85.203.15.233:48183] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aeLl0v1e7hG8DAeABB9o1gAAAQ0"]
[Sat Apr 18 10:00:52.220061 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.36:48633] [client 85.203.15.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aeLl1P1e7hG8DAeABB9o8AAAAQw"]
[Sat Apr 18 10:00:53.851222 2026] [proxy_fcgi:error] [pid 13023:tid 13032] [client 85.203.15.38:40783] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:00:54.183520 2026] [proxy_fcgi:error] [pid 13023:tid 13049] [client 85.203.15.38:40783] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:00:54.537966 2026] [proxy_fcgi:error] [pid 13023:tid 13034] [client 85.203.15.38:40783] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:00:57.271465 2026] [:error] [pid 13023:tid 13038] [client 85.203.15.38:40783] [client 85.203.15.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aeLl2f1e7hG8DAeABB9pFwAAAQ0"]
[Sat Apr 18 10:00:57.912047 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.18:52517] [client 85.203.15.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aeLl2f1e7hG8DAeABB9pGgAAAQw"]
[Sat Apr 18 10:00:58.552483 2026] [:error] [pid 9864:tid 9919] [client 85.203.15.33:25897] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aeLl2oCFeowknfXHM7lpwwAAAE0"]
[Sat Apr 18 10:00:59.190223 2026] [:error] [pid 9864:tid 9918] [client 81.199.26.72:57697] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aeLl24CFeowknfXHM7lpyAAAAEw"]
[Sat Apr 18 10:00:59.830723 2026] [:error] [pid 9864:tid 9908] [client 85.203.15.11:43905] [client 85.203.15.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aeLl24CFeowknfXHM7lpzwAAAEM"]
[Sat Apr 18 10:01:00.493879 2026] [:error] [pid 9864:tid 9924] [client 81.199.26.82:59173] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aeLl3ICFeowknfXHM7lp0gAAAFI"]
[Sat Apr 18 10:01:01.504114 2026] [:error] [pid 9863:tid 9895] [client 81.199.26.80:55835] [client 81.199.26.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aeLl3TjjiypiFrTucbJItwAAABY"]
[Sat Apr 18 10:01:02.144012 2026] [:error] [pid 34237:tid 34252] [client 85.203.15.4:25531] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aeLl3hBmX4Wq5a6rxfYQlAAAAU0"]
[Sat Apr 18 10:01:02.780286 2026] [:error] [pid 34237:tid 34242] [client 85.203.15.237:40013] [client 85.203.15.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aeLl3hBmX4Wq5a6rxfYQmwAAAUM"]
[Sat Apr 18 10:01:03.431769 2026] [:error] [pid 9970:tid 9988] [client 81.199.26.85:47963] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aeLl3yYdRLRhVmaIMx0fZQAAAM4"]
[Sat Apr 18 10:01:04.732131 2026] [:error] [pid 9863:tid 9892] [client 81.199.26.72:64215] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aeLl4DjjiypiFrTucbJIyQAAABM"]
[Sat Apr 18 10:01:05.701649 2026] [:error] [pid 13023:tid 13039] [client 85.203.15.26:35971] [client 85.203.15.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aeLl4f1e7hG8DAeABB9pLQAAAQ4"]
[Sat Apr 18 10:01:07.031320 2026] [:error] [pid 9863:tid 9890] [client 85.203.15.4:45757] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aeLl4zjjiypiFrTucbJI2QAAABE"]
[Sat Apr 18 10:01:08.319605 2026] [:error] [pid 9863:tid 9873] [client 85.203.15.10:51513] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/about.php"] [unique_id "aeLl5DjjiypiFrTucbJI5QAAAAA"]
[Sat Apr 18 10:01:09.930462 2026] [:error] [pid 13023:tid 13047] [client 81.199.26.79:37323] [client 81.199.26.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aeLl5f1e7hG8DAeABB9pQgAAARY"]
[Sat Apr 18 10:01:11.873330 2026] [:error] [pid 9865:tid 9959] [client 81.199.26.87:41271] [client 81.199.26.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aeLl56zb5knECIY-C-j02gAAAJY"]
[Sat Apr 18 10:01:12.858724 2026] [:error] [pid 9970:tid 9987] [client 81.199.26.72:32651] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aeLl6CYdRLRhVmaIMx0feAAAAM0"]
[Sat Apr 18 10:01:19.834173 2026] [:error] [pid 34237:tid 34260] [client 85.203.15.20:36415] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aeLl7xBmX4Wq5a6rxfYQ1QAAAVU"]
[Sat Apr 18 10:01:20.474381 2026] [:error] [pid 13023:tid 13030] [client 85.203.15.235:41565] [client 85.203.15.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aeLl8P1e7hG8DAeABB9pewAAAQU"]
[Sat Apr 18 10:01:21.461663 2026] [:error] [pid 9863:tid 9889] [client 85.203.15.32:60957] [client 85.203.15.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aeLl8TjjiypiFrTucbJI_gAAABA"]
[Sat Apr 18 10:01:22.756854 2026] [:error] [pid 34288:tid 34293] [client 81.199.26.78:38977] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aeLl8uTIiy__PtiLmpltNQAAAYE"]
[Sat Apr 18 10:01:23.396597 2026] [:error] [pid 13023:tid 13035] [client 85.203.15.236:58923] [client 85.203.15.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aeLl8_1e7hG8DAeABB9phAAAAQo"]
[Sat Apr 18 10:01:25.361678 2026] [:error] [pid 13023:tid 13038] [client 81.199.26.83:30521] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeLl9f1e7hG8DAeABB9plAAAAQ0"]
[Sat Apr 18 10:01:26.008186 2026] [:error] [pid 34290:tid 34343] [client 81.199.26.81:54157] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aeLl9hqX6WpmmAXOBi-JBgAAAdg"]
[Sat Apr 18 10:01:28.304148 2026] [:error] [pid 13023:tid 13029] [client 85.203.15.21:50521] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aeLl-P1e7hG8DAeABB9prwAAAQQ"]
[Sat Apr 18 10:01:29.295551 2026] [proxy_fcgi:error] [pid 13023:tid 13036] [client 81.199.26.77:25161] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:01:29.934601 2026] [:error] [pid 13023:tid 13026] [client 81.199.26.77:25161] [client 81.199.26.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/function.php"] [unique_id "aeLl-f1e7hG8DAeABB9ptwAAAQE"]
[Sat Apr 18 10:01:30.614166 2026] [:error] [pid 9970:tid 9978] [client 81.199.26.87:26099] [client 81.199.26.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugins.php"] [unique_id "aeLl-iYdRLRhVmaIMx0flAAAAMQ"]
[Sat Apr 18 10:01:31.941180 2026] [:error] [pid 34288:tid 34310] [client 81.199.26.85:63501] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aeLl--TIiy__PtiLmpltYAAAAZI"]
[Sat Apr 18 10:01:32.585932 2026] [:error] [pid 13023:tid 13041] [client 81.199.26.86:52037] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aeLl_P1e7hG8DAeABB9pvwAAARA"]
[Sat Apr 18 10:01:36.767296 2026] [:error] [pid 34237:tid 34250] [client 85.203.15.33:36381] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aeLmABBmX4Wq5a6rxfYQ6gAAAUs"]
[Sat Apr 18 10:01:37.413614 2026] [:error] [pid 9865:tid 9939] [client 85.203.15.6:25829] [client 85.203.15.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aeLmAazb5knECIY-C-j08gAAAII"]
[Sat Apr 18 10:01:39.357426 2026] [:error] [pid 9865:tid 9944] [client 85.203.15.13:39791] [client 85.203.15.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "aeLmA6zb5knECIY-C-j0_QAAAIc"]
[Sat Apr 18 10:01:39.995980 2026] [:error] [pid 13023:tid 13034] [client 81.199.26.85:33571] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aeLmA_1e7hG8DAeABB9p4AAAAQk"]
[Sat Apr 18 10:01:40.631334 2026] [:error] [pid 9863:tid 9883] [client 85.203.15.234:30833] [client 85.203.15.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aeLmBDjjiypiFrTucbJJJAAAAAo"]
[Sat Apr 18 10:01:44.022281 2026] [:error] [pid 9863:tid 9897] [client 81.199.26.78:30413] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aeLmCDjjiypiFrTucbJJNwAAABg"]
[Sat Apr 18 10:01:44.985613 2026] [:error] [pid 34288:tid 34309] [client 85.203.15.32:36915] [client 85.203.15.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aeLmCOTIiy__PtiLmpltlgAAAZE"]
[Sat Apr 18 10:01:47.888508 2026] [:error] [pid 34288:tid 34303] [client 85.203.15.242:56197] [client 85.203.15.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.242, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/js/wp-login.php"] [unique_id "aeLmC-TIiy__PtiLmpltvAAAAYs"]
[Sat Apr 18 10:01:49.835161 2026] [:error] [pid 34288:tid 34305] [client 85.203.15.242:56197] [client 85.203.15.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.242, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aeLmDeTIiy__PtiLmpltygAAAY0"]
[Sat Apr 18 10:01:53.384334 2026] [proxy_fcgi:error] [pid 34288:tid 34309] [client 85.203.15.242:56197] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:01:59.452954 2026] [:error] [pid 34288:tid 34306] [client 85.203.15.242:56197] [client 85.203.15.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aeLmF-TIiy__PtiLmpluDgAAAY4"]
[Sat Apr 18 10:02:01.102330 2026] [:error] [pid 34288:tid 34310] [client 81.199.26.88:26737] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aeLmGeTIiy__PtiLmpluGQAAAZI"]
[Sat Apr 18 10:02:02.398326 2026] [:error] [pid 34237:tid 34240] [client 81.199.26.73:64643] [client 81.199.26.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aeLmGhBmX4Wq5a6rxfYRAQAAAUE"]
[Sat Apr 18 10:02:05.969688 2026] [:error] [pid 34237:tid 34239] [client 85.203.15.29:34881] [client 85.203.15.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aeLmHRBmX4Wq5a6rxfYRDgAAAUA"]
[Sat Apr 18 10:02:07.259304 2026] [:error] [pid 13023:tid 13025] [client 85.203.15.9:47199] [client 85.203.15.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aeLmH_1e7hG8DAeABB9qbAAAAQA"]
[Sat Apr 18 10:02:08.230363 2026] [:error] [pid 9864:tid 9908] [client 85.203.15.2:59273] [client 85.203.15.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aeLmIICFeowknfXHM7lqAAAAAEM"]
[Sat Apr 18 10:02:10.186566 2026] [proxy_fcgi:error] [pid 34237:tid 34252] [client 85.203.15.4:22647] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:02:10.510343 2026] [proxy_fcgi:error] [pid 34237:tid 34247] [client 85.203.15.4:22647] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:02:10.830285 2026] [:error] [pid 34237:tid 34244] [client 85.203.15.4:22647] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aeLmIhBmX4Wq5a6rxfYRHgAAAUU"]
[Sat Apr 18 10:02:11.470859 2026] [:error] [pid 13023:tid 13028] [client 81.199.26.73:50321] [client 81.199.26.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aeLmI_1e7hG8DAeABB9qfAAAAQM"]
[Sat Apr 18 10:02:14.442405 2026] [:error] [pid 13023:tid 13039] [client 85.203.15.233:63011] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aeLmJv1e7hG8DAeABB9qkQAAAQ4"]
[Sat Apr 18 10:02:16.499335 2026] [:error] [pid 34288:tid 34304] [client 85.203.15.235:22101] [client 85.203.15.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "aeLmKOTIiy__PtiLmpluZAAAAYw"]
[Sat Apr 18 10:02:18.141477 2026] [:error] [pid 34237:tid 34254] [client 81.199.26.81:37253] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aeLmKhBmX4Wq5a6rxfYRLwAAAU8"]
[Sat Apr 18 10:02:21.097456 2026] [:error] [pid 9970:tid 9985] [client 85.203.15.233:33141] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aeLmLSYdRLRhVmaIMx0fzwAAAMs"]
[Sat Apr 18 10:02:21.739539 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 85.203.15.15:22689] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:02:22.710316 2026] [:error] [pid 13023:tid 13043] [client 85.203.15.15:22689] [client 85.203.15.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aeLmLv1e7hG8DAeABB9qvAAAARI"]
[Sat Apr 18 10:02:25.000249 2026] [proxy_fcgi:error] [pid 9970:tid 9986] [client 85.203.15.14:53781] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:02:25.649265 2026] [:error] [pid 9970:tid 9982] [client 85.203.15.14:53781] [client 85.203.15.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.14, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aeLmMSYdRLRhVmaIMx0f5QAAAMg"]
[Sat Apr 18 10:02:27.285687 2026] [:error] [pid 9970:tid 9988] [client 85.203.15.14:53781] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aeLmMyYdRLRhVmaIMx0f6gAAAM4"]
[Sat Apr 18 10:02:28.250316 2026] [:error] [pid 13023:tid 13031] [client 85.203.15.9:52507] [client 85.203.15.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aeLmNP1e7hG8DAeABB9q0gAAAQY"]
[Sat Apr 18 10:02:30.208375 2026] [:error] [pid 34237:tid 34247] [client 85.203.15.19:40367] [client 85.203.15.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aeLmNhBmX4Wq5a6rxfYRRgAAAUg"]
[Sat Apr 18 10:02:31.827870 2026] [:error] [pid 9864:tid 9918] [client 85.203.15.33:59269] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aeLmN4CFeowknfXHM7lqGgAAAEw"]
[Sat Apr 18 10:02:34.202389 2026] [:error] [pid 9864:tid 9929] [client 85.203.15.14:64657] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aeLmOoCFeowknfXHM7lqHQAAAFc"]
[Sat Apr 18 10:02:37.166598 2026] [:error] [pid 34237:tid 34256] [client 85.203.15.245:29147] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aeLmPRBmX4Wq5a6rxfYRZgAAAVE"]
[Sat Apr 18 10:02:38.481343 2026] [proxy_fcgi:error] [pid 9863:tid 9891] [client 81.199.26.82:27633] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:02:39.412912 2026] [:error] [pid 9863:tid 9879] [client 81.199.26.82:27633] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aeLmPzjjiypiFrTucbJJlQAAAAY"]
[Sat Apr 18 10:02:40.372778 2026] [:error] [pid 9970:tid 9983] [client 85.203.15.238:42393] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/db.php"] [unique_id "aeLmQCYdRLRhVmaIMx0f-QAAAMk"]
[Sat Apr 18 10:02:41.013448 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.245:30781] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aeLmQf1e7hG8DAeABB9rAwAAAQw"]
[Sat Apr 18 10:02:41.656557 2026] [:error] [pid 13023:tid 13026] [client 81.199.26.80:57055] [client 81.199.26.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aeLmQf1e7hG8DAeABB9rCQAAAQE"]
[Sat Apr 18 10:02:42.298849 2026] [:error] [pid 13023:tid 13031] [client 81.199.26.77:39505] [client 81.199.26.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aeLmQv1e7hG8DAeABB9rDgAAAQY"]
[Sat Apr 18 10:02:42.939904 2026] [:error] [pid 13023:tid 13047] [client 85.203.15.242:44449] [client 85.203.15.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aeLmQv1e7hG8DAeABB9rEwAAARY"]
[Sat Apr 18 10:02:43.574184 2026] [:error] [pid 34288:tid 34293] [client 81.199.26.86:58529] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aeLmQ-TIiy__PtiLmplujwAAAYE"]
[Sat Apr 18 10:02:44.856728 2026] [:error] [pid 9863:tid 9891] [client 81.199.26.83:39809] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aeLmRDjjiypiFrTucbJJpwAAABI"]
[Sat Apr 18 10:02:45.501779 2026] [:error] [pid 9863:tid 9875] [client 85.203.15.13:43891] [client 85.203.15.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aeLmRTjjiypiFrTucbJJrQAAAAI"]
[Sat Apr 18 10:02:46.154558 2026] [:error] [pid 9863:tid 9892] [client 85.203.15.239:25221] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aeLmRjjjiypiFrTucbJJsQAAABM"]
[Sat Apr 18 10:02:46.796362 2026] [:error] [pid 9863:tid 9879] [client 81.199.26.86:64553] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aeLmRjjjiypiFrTucbJJtwAAAAY"]
[Sat Apr 18 10:02:47.440770 2026] [:error] [pid 13023:tid 13027] [client 85.203.15.13:48541] [client 85.203.15.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aeLmR_1e7hG8DAeABB9rIQAAAQI"]
[Sat Apr 18 10:02:48.087876 2026] [proxy_fcgi:error] [pid 9865:tid 9959] [client 81.199.26.77:44119] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:02:49.056723 2026] [:error] [pid 9865:tid 9956] [client 81.199.26.77:44119] [client 81.199.26.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.199.26.77, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aeLmSazb5knECIY-C-j1bQAAAJM"]
[Sat Apr 18 10:02:50.687763 2026] [:error] [pid 9865:tid 9939] [client 81.199.26.77:44119] [client 81.199.26.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aeLmSqzb5knECIY-C-j1dQAAAII"]
[Sat Apr 18 10:02:56.523758 2026] [:error] [pid 34237:tid 34244] [client 81.199.26.71:62749] [client 81.199.26.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aeLmUBBmX4Wq5a6rxfYRhwAAAUU"]
[Sat Apr 18 10:02:57.181401 2026] [:error] [pid 9863:tid 9883] [client 85.203.15.16:40819] [client 85.203.15.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aeLmUTjjiypiFrTucbJJzQAAAAo"]
[Sat Apr 18 10:02:57.825059 2026] [:error] [pid 34237:tid 34242] [client 85.203.15.18:23153] [client 85.203.15.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aeLmURBmX4Wq5a6rxfYRigAAAUM"]
[Sat Apr 18 10:03:00.441129 2026] [:error] [pid 13023:tid 13040] [client 85.203.15.21:27157] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aeLmVP1e7hG8DAeABB9rcAAAAQ8"]
[Sat Apr 18 10:03:01.099968 2026] [:error] [pid 34237:tid 34248] [client 81.199.26.86:62701] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aeLmVRBmX4Wq5a6rxfYRjwAAAUk"]
[Sat Apr 18 10:03:01.804904 2026] [:error] [pid 34288:tid 34314] [client 81.199.26.82:27279] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aeLmVeTIiy__PtiLmpluwgAAAZY"]
[Sat Apr 18 10:03:03.776649 2026] [:error] [pid 9865:tid 9944] [client 85.203.15.2:55017] [client 85.203.15.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aeLmV6zb5knECIY-C-j1hgAAAIc"]
[Sat Apr 18 10:03:04.742930 2026] [:error] [pid 34290:tid 34334] [client 81.199.26.83:63207] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aeLmWBqX6WpmmAXOBi-JUQAAAc8"]
[Sat Apr 18 10:03:07.580559 2026] [:error] [pid 34237:tid 34241] [client 85.203.15.233:62461] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aeLmWxBmX4Wq5a6rxfYRlwAAAUI"]
[Sat Apr 18 10:03:11.792331 2026] [:error] [pid 9865:tid 9952] [client 81.199.26.77:40363] [client 81.199.26.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aeLmX6zb5knECIY-C-j1rAAAAI8"]
[Sat Apr 18 10:03:12.772711 2026] [:error] [pid 34288:tid 34297] [client 85.203.15.33:25703] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "aeLmYOTIiy__PtiLmplu6wAAAYU"]
[Sat Apr 18 10:03:15.388911 2026] [:error] [pid 9863:tid 9885] [client 81.199.26.75:51855] [client 81.199.26.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aeLmYzjjiypiFrTucbJKHgAAAAw"]
[Sat Apr 18 10:03:16.692013 2026] [:error] [pid 34288:tid 34298] [client 85.203.15.245:51345] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aeLmZOTIiy__PtiLmplvCQAAAYY"]
[Sat Apr 18 10:03:18.675598 2026] [:error] [pid 9865:tid 9944] [client 85.203.15.18:26103] [client 85.203.15.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aeLmZqzb5knECIY-C-j1wwAAAIc"]
[Sat Apr 18 10:03:20.617853 2026] [:error] [pid 13023:tid 13043] [client 85.203.15.233:59343] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aeLmaP1e7hG8DAeABB9rswAAARI"]
[Sat Apr 18 10:03:21.911503 2026] [:error] [pid 13023:tid 13039] [client 81.199.26.81:50179] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aeLmaf1e7hG8DAeABB9rvQAAAQ4"]
[Sat Apr 18 10:03:22.560520 2026] [:error] [pid 9970:tid 9985] [client 85.203.15.25:60711] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aeLmaiYdRLRhVmaIMx0gIgAAAMs"]
[Sat Apr 18 10:03:26.278210 2026] [:error] [pid 34288:tid 34308] [client 81.199.26.88:43107] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aeLmbuTIiy__PtiLmplvNAAAAZA"]
[Sat Apr 18 10:03:28.541955 2026] [:error] [pid 13023:tid 13033] [client 81.199.26.86:53175] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aeLmcP1e7hG8DAeABB9r3gAAAQg"]
[Sat Apr 18 10:03:30.479468 2026] [:error] [pid 9970:tid 9974] [client 85.203.15.238:42241] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeLmciYdRLRhVmaIMx0gLAAAAMA"]
[Sat Apr 18 10:03:31.170120 2026] [:error] [pid 34288:tid 34305] [client 85.203.15.20:41817] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aeLmc-TIiy__PtiLmplvOgAAAY0"]
[Sat Apr 18 10:03:32.146948 2026] [:error] [pid 13023:tid 13045] [client 81.199.26.88:57419] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aeLmdP1e7hG8DAeABB9r7AAAARQ"]
[Sat Apr 18 10:03:33.458377 2026] [:error] [pid 13023:tid 13044] [client 85.203.15.238:22705] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/install.php"] [unique_id "aeLmdf1e7hG8DAeABB9r9AAAARM"]
[Sat Apr 18 10:03:34.106649 2026] [:error] [pid 13023:tid 13048] [client 85.203.15.19:57065] [client 85.203.15.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aeLmdv1e7hG8DAeABB9r9wAAARc"]
[Sat Apr 18 10:03:36.712495 2026] [:error] [pid 34290:tid 34339] [client 85.203.15.13:63767] [client 85.203.15.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/category-double.php"] [unique_id "aeLmeBqX6WpmmAXOBi-JbwAAAdQ"]
[Sat Apr 18 10:03:38.015698 2026] [:error] [pid 9970:tid 9992] [client 81.199.26.76:40673] [client 81.199.26.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aeLmeiYdRLRhVmaIMx0gPAAAANI"]
[Sat Apr 18 10:03:38.657523 2026] [:error] [pid 9865:tid 9945] [client 85.203.15.21:61497] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aeLmeqzb5knECIY-C-j19AAAAIg"]
[Sat Apr 18 10:03:39.968815 2026] [:error] [pid 9864:tid 9913] [client 85.203.15.32:55559] [client 85.203.15.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aeLme4CFeowknfXHM7lqbgAAAEc"]
[Sat Apr 18 10:03:40.948081 2026] [:error] [pid 9863:tid 9890] [client 81.199.26.85:48481] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aeLmfDjjiypiFrTucbJKWAAAABE"]
[Sat Apr 18 10:03:43.233626 2026] [:error] [pid 13023:tid 13045] [client 81.199.26.87:64245] [client 81.199.26.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aeLmf_1e7hG8DAeABB9sJAAAARQ"]
[Sat Apr 18 10:03:44.535802 2026] [:error] [pid 9863:tid 9894] [client 81.199.26.74:34029] [client 81.199.26.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aeLmgDjjiypiFrTucbJKfQAAABU"]
[Sat Apr 18 10:03:45.839181 2026] [:error] [pid 13023:tid 13032] [client 85.203.15.235:57863] [client 85.203.15.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aeLmgf1e7hG8DAeABB9sNAAAAQc"]
[Sat Apr 18 10:03:46.826642 2026] [:error] [pid 13023:tid 13032] [client 85.203.15.239:62837] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/as.php"] [unique_id "aeLmgv1e7hG8DAeABB9sQwAAAQc"]
[Sat Apr 18 10:03:47.819496 2026] [:error] [pid 9863:tid 9890] [client 85.203.15.14:55699] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aeLmgzjjiypiFrTucbJKhQAAABE"]
[Sat Apr 18 10:03:48.465383 2026] [:error] [pid 9863:tid 9876] [client 81.199.26.88:59707] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/install.php"] [unique_id "aeLmhDjjiypiFrTucbJKiAAAAAM"]
[Sat Apr 18 10:03:49.109571 2026] [:error] [pid 13023:tid 13041] [client 85.203.15.10:31189] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aeLmhf1e7hG8DAeABB9sVQAAARA"]
[Sat Apr 18 10:03:51.729360 2026] [:error] [pid 9863:tid 9893] [client 85.203.15.20:31487] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aeLmhzjjiypiFrTucbJKnQAAABQ"]
[Sat Apr 18 10:03:54.691219 2026] [:error] [pid 34290:tid 34323] [client 85.203.15.239:44707] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rk2.php"] [unique_id "aeLmihqX6WpmmAXOBi-JkAAAAcQ"]
[Sat Apr 18 10:03:56.004490 2026] [:error] [pid 9863:tid 9889] [client 81.199.26.86:55447] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aeLmjDjjiypiFrTucbJKpgAAABA"]
[Sat Apr 18 10:03:57.301132 2026] [:error] [pid 9863:tid 9887] [client 85.203.15.33:32709] [client 85.203.15.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aeLmjTjjiypiFrTucbJKsAAAAA4"]
[Sat Apr 18 10:03:59.580650 2026] [:error] [pid 9865:tid 9937] [client 81.199.26.75:63501] [client 81.199.26.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aeLmj6zb5knECIY-C-j2EQAAAIA"]
[Sat Apr 18 10:04:00.561427 2026] [:error] [pid 9863:tid 9892] [client 85.203.15.9:63917] [client 85.203.15.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aeLmkDjjiypiFrTucbJKtAAAABM"]
[Sat Apr 18 10:04:01.554824 2026] [:error] [pid 9865:tid 9945] [client 81.199.26.86:39371] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aeLmkazb5knECIY-C-j2EwAAAIg"]
[Sat Apr 18 10:04:02.868015 2026] [:error] [pid 34288:tid 34294] [client 85.203.15.237:44309] [client 85.203.15.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aeLmkuTIiy__PtiLmplvcwAAAYI"]
[Sat Apr 18 10:04:06.160962 2026] [:error] [pid 34288:tid 34297] [client 81.199.26.88:33323] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aeLmluTIiy__PtiLmplvfwAAAYU"]
[Sat Apr 18 10:04:06.809881 2026] [:error] [pid 9863:tid 9895] [client 81.199.26.81:61871] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aeLmljjjiypiFrTucbJKyQAAABY"]
[Sat Apr 18 10:04:08.449770 2026] [:error] [pid 13023:tid 13028] [client 85.203.15.15:56647] [client 85.203.15.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aeLmmP1e7hG8DAeABB9sYQAAAQM"]
[Sat Apr 18 10:04:09.106010 2026] [:error] [pid 34288:tid 34294] [client 85.203.15.14:44125] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeLmmeTIiy__PtiLmplvgAAAAYI"]
[Sat Apr 18 10:04:10.411081 2026] [:error] [pid 9863:tid 9879] [client 85.203.15.6:33545] [client 85.203.15.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aeLmmjjjiypiFrTucbJK0wAAAAY"]
[Sat Apr 18 10:04:11.063561 2026] [:error] [pid 9864:tid 9922] [client 85.203.15.25:35179] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aeLmm4CFeowknfXHM7lqkwAAAFA"]
[Sat Apr 18 10:04:11.710503 2026] [:error] [pid 9970:tid 9990] [client 81.199.26.85:44769] [client 81.199.26.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.199.26.85, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aeLmmyYdRLRhVmaIMx0gYQAAANA"]
[Sat Apr 18 10:04:11.719796 2026] [proxy_fcgi:error] [pid 9970:tid 9990] [client 81.199.26.85:44769] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:04:12.045991 2026] [:error] [pid 9970:tid 9993] [client 81.199.26.85:44769] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aeLmnCYdRLRhVmaIMx0gYgAAANM"]
[Sat Apr 18 10:04:13.338579 2026] [:error] [pid 9864:tid 9920] [client 85.203.15.9:37741] [client 85.203.15.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aeLmnYCFeowknfXHM7lqmQAAAE4"]
[Sat Apr 18 10:04:13.986693 2026] [:error] [pid 9864:tid 9907] [client 85.203.15.26:26185] [client 85.203.15.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/network.php"] [unique_id "aeLmnYCFeowknfXHM7lqmgAAAEI"]
[Sat Apr 18 10:04:16.977021 2026] [:error] [pid 34237:tid 34249] [client 85.203.15.3:38995] [client 85.203.15.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aeLmoBBmX4Wq5a6rxfYR1wAAAUo"]
[Sat Apr 18 10:04:17.629533 2026] [:error] [pid 9865:tid 9941] [client 81.199.26.88:45597] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aeLmoazb5knECIY-C-j2LAAAAIQ"]
[Sat Apr 18 10:04:18.925765 2026] [:error] [pid 9863:tid 9897] [client 81.199.26.78:65473] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aeLmojjjiypiFrTucbJK5AAAABg"]
[Sat Apr 18 10:04:19.573245 2026] [:error] [pid 9970:tid 9977] [client 81.199.26.72:38301] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aeLmoyYdRLRhVmaIMx0gcgAAAMM"]
[Sat Apr 18 10:04:20.221010 2026] [proxy_fcgi:error] [pid 9865:tid 9947] [client 85.203.15.25:38611] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:04:20.545027 2026] [:error] [pid 9865:tid 9958] [client 85.203.15.25:38611] [client 85.203.15.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.25, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aeLmpKzb5knECIY-C-j2NwAAAJU"]
[Sat Apr 18 10:04:21.202735 2026] [:error] [pid 9865:tid 9939] [client 85.203.15.25:38611] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aeLmpazb5knECIY-C-j2OwAAAII"]
[Sat Apr 18 10:04:22.853796 2026] [:error] [pid 34290:tid 34338] [client 85.203.15.14:42555] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aeLmphqX6WpmmAXOBi-JoAAAAdM"]
[Sat Apr 18 10:04:23.829170 2026] [:error] [pid 9864:tid 9923] [client 85.203.15.245:49457] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aeLmp4CFeowknfXHM7lqrwAAAFE"]
[Sat Apr 18 10:04:24.475072 2026] [:error] [pid 9970:tid 9986] [client 85.203.15.14:40899] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aeLmqCYdRLRhVmaIMx0gggAAAMw"]
[Sat Apr 18 10:04:26.104158 2026] [:error] [pid 9970:tid 9992] [client 81.199.26.88:48991] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aeLmqiYdRLRhVmaIMx0gigAAANI"]
[Sat Apr 18 10:04:27.397052 2026] [:error] [pid 13023:tid 13033] [client 85.203.15.21:42435] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aeLmq_1e7hG8DAeABB9sggAAAQg"]
[Sat Apr 18 10:04:29.351137 2026] [:error] [pid 34288:tid 34295] [client 85.203.15.21:36705] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aeLmreTIiy__PtiLmplvngAAAYM"]
[Sat Apr 18 10:04:30.003892 2026] [:error] [pid 9970:tid 9997] [client 81.199.26.78:60817] [client 81.199.26.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bypass.php"] [unique_id "aeLmriYdRLRhVmaIMx0gkgAAANc"]
[Sat Apr 18 10:04:30.981103 2026] [:error] [pid 9865:tid 9939] [client 85.203.15.17:24961] [client 85.203.15.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/count.php"] [unique_id "aeLmrqzb5knECIY-C-j2VwAAAII"]
[Sat Apr 18 10:04:33.625035 2026] [:error] [pid 9863:tid 9890] [client 85.203.15.17:39985] [client 85.203.15.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aeLmsTjjiypiFrTucbJK-QAAABE"]
[Sat Apr 18 10:04:34.938151 2026] [:error] [pid 34237:tid 34256] [client 81.199.26.81:26587] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com"] [uri "/images/stories/themes.php"] [unique_id "aeLmshBmX4Wq5a6rxfYR6AAAAVE"]
[Sat Apr 18 10:04:35.261661 2026] [:error] [pid 34237:tid 34239] [client 81.199.26.81:26587] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aeLmsxBmX4Wq5a6rxfYR6QAAAUA"]
[Sat Apr 18 10:04:36.585632 2026] [:error] [pid 9865:tid 9942] [client 85.203.15.4:29497] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aeLmtKzb5knECIY-C-j2YgAAAIU"]
[Sat Apr 18 10:04:37.233691 2026] [:error] [pid 34288:tid 34303] [client 81.199.26.74:41917] [client 81.199.26.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aeLmteTIiy__PtiLmplvqgAAAYs"]
[Sat Apr 18 10:04:39.829009 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.239:54775] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aeLmt_1e7hG8DAeABB9slwAAAQw"]
[Sat Apr 18 10:04:41.138504 2026] [:error] [pid 9865:tid 9955] [client 85.203.15.10:25465] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aeLmuazb5knECIY-C-j2aAAAAJI"]
[Sat Apr 18 10:04:42.117246 2026] [:error] [pid 9863:tid 9882] [client 85.203.15.233:64151] [client 85.203.15.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aeLmujjjiypiFrTucbJLCQAAAAk"]
[Sat Apr 18 10:04:45.539990 2026] [:error] [pid 9863:tid 9886] [client 85.203.15.38:59599] [client 85.203.15.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aeLmvTjjiypiFrTucbJLEwAAAA0"]
[Sat Apr 18 10:04:46.188570 2026] [:error] [pid 9865:tid 9956] [client 81.199.26.87:49135] [client 81.199.26.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/colour.php"] [unique_id "aeLmvqzb5knECIY-C-j2dQAAAJM"]
[Sat Apr 18 10:04:47.171892 2026] [:error] [pid 9864:tid 9910] [client 85.203.15.10:45071] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aeLmv4CFeowknfXHM7lqtQAAAEU"]
[Sat Apr 18 10:04:47.831508 2026] [:error] [pid 9863:tid 9890] [client 85.203.15.21:29963] [client 85.203.15.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/include.php"] [unique_id "aeLmvzjjiypiFrTucbJLFAAAABE"]
[Sat Apr 18 10:04:49.137852 2026] [:error] [pid 13023:tid 13026] [client 85.203.15.11:42477] [client 85.203.15.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aeLmwf1e7hG8DAeABB9ssQAAAQE"]
[Sat Apr 18 10:04:50.445408 2026] [:error] [pid 9970:tid 9991] [client 81.199.26.73:37837] [client 81.199.26.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aeLmwiYdRLRhVmaIMx0gqQAAANE"]
[Sat Apr 18 10:04:51.100431 2026] [:error] [pid 13023:tid 13045] [client 81.199.26.75:38261] [client 81.199.26.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aeLmw_1e7hG8DAeABB9svAAAARQ"]
[Sat Apr 18 10:04:53.062934 2026] [:error] [pid 13023:tid 13041] [client 85.203.15.19:25549] [client 85.203.15.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aeLmxf1e7hG8DAeABB9sxgAAARA"]
[Sat Apr 18 10:04:54.358813 2026] [:error] [pid 13023:tid 13039] [client 85.203.15.16:56677] [client 85.203.15.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aeLmxv1e7hG8DAeABB9szgAAAQ4"]
[Sat Apr 18 10:04:55.988606 2026] [:error] [pid 34237:tid 34257] [client 81.199.26.86:37573] [client 81.199.26.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aeLmxxBmX4Wq5a6rxfYSDwAAAVI"]
[Sat Apr 18 10:04:56.639418 2026] [:error] [pid 9970:tid 9995] [client 85.203.15.238:23305] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aeLmyCYdRLRhVmaIMx0grAAAANU"]
[Sat Apr 18 10:04:57.281820 2026] [:error] [pid 9863:tid 9895] [client 81.199.26.85:22201] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aeLmyTjjiypiFrTucbJLKQAAABY"]
[Sat Apr 18 10:05:00.343320 2026] [:error] [pid 9865:tid 9958] [client 81.199.26.82:62351] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aeLmzKzb5knECIY-C-j2gQAAAJU"]
[Sat Apr 18 10:05:01.850044 2026] [:error] [pid 34288:tid 34303] [client 85.203.15.239:58183] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aeLmzeTIiy__PtiLmplvxgAAAYs"]
[Sat Apr 18 10:05:02.727970 2026] [:error] [pid 9970:tid 9979] [client 81.199.26.79:48895] [client 81.199.26.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aeLmziYdRLRhVmaIMx0gtQAAAMU"]
[Sat Apr 18 10:05:03.776137 2026] [:error] [pid 13023:tid 13038] [client 85.203.15.11:37493] [client 85.203.15.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aeLmz_1e7hG8DAeABB9s3wAAAQ0"]
[Sat Apr 18 10:05:04.426220 2026] [:error] [pid 34237:tid 34254] [client 85.203.15.20:31559] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aeLm0BBmX4Wq5a6rxfYSHgAAAU8"]
[Sat Apr 18 10:05:05.742908 2026] [:error] [pid 9863:tid 9877] [client 81.199.26.84:53281] [client 81.199.26.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aeLm0TjjiypiFrTucbJLQQAAAAQ"]
[Sat Apr 18 10:05:06.726143 2026] [:error] [pid 13023:tid 13029] [client 85.203.15.29:47809] [client 85.203.15.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aeLm0v1e7hG8DAeABB9s7QAAAQQ"]
[Sat Apr 18 10:05:07.371502 2026] [:error] [pid 34237:tid 34262] [client 81.199.26.82:22221] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aeLm0xBmX4Wq5a6rxfYSJQAAAVc"]
[Sat Apr 18 10:05:08.023471 2026] [:error] [pid 9865:tid 9951] [client 85.203.15.238:31043] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aeLm1Kzb5knECIY-C-j2jQAAAI4"]
[Sat Apr 18 10:05:09.329832 2026] [:error] [pid 13023:tid 13045] [client 85.203.15.6:28723] [client 85.203.15.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aeLm1f1e7hG8DAeABB9s9wAAARQ"]
[Sat Apr 18 10:05:10.627648 2026] [:error] [pid 13023:tid 13035] [client 85.203.15.10:43441] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aeLm1v1e7hG8DAeABB9tAwAAAQo"]
[Sat Apr 18 10:05:11.610576 2026] [:error] [pid 34288:tid 34302] [client 85.203.15.10:65067] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aeLm1-TIiy__PtiLmplv2AAAAYo"]
[Sat Apr 18 10:05:12.590424 2026] [:error] [pid 34237:tid 34246] [client 81.199.26.83:62763] [client 81.199.26.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aeLm2BBmX4Wq5a6rxfYSLwAAAUc"]
[Sat Apr 18 10:05:15.205696 2026] [:error] [pid 34237:tid 34252] [client 85.203.15.38:31693] [client 85.203.15.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugin.php"] [unique_id "aeLm2xBmX4Wq5a6rxfYSNwAAAU0"]
[Sat Apr 18 10:05:15.857466 2026] [:error] [pid 34237:tid 34248] [client 85.203.15.242:56111] [client 85.203.15.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aeLm2xBmX4Wq5a6rxfYSOAAAAUk"]
[Sat Apr 18 10:05:17.174761 2026] [:error] [pid 13023:tid 13037] [client 81.199.26.85:64125] [client 81.199.26.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aeLm3f1e7hG8DAeABB9tGAAAAQw"]
[Sat Apr 18 10:05:19.139781 2026] [:error] [pid 13023:tid 13042] [client 81.199.26.88:47041] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aeLm3_1e7hG8DAeABB9tLQAAARE"]
[Sat Apr 18 10:05:20.449699 2026] [:error] [pid 9863:tid 9894] [client 81.199.26.77:37673] [client 81.199.26.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aeLm4DjjiypiFrTucbJLYQAAABU"]
[Sat Apr 18 10:05:21.762636 2026] [:error] [pid 9863:tid 9876] [client 85.203.15.14:65075] [client 85.203.15.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aeLm4TjjiypiFrTucbJLZQAAAAM"]
[Sat Apr 18 10:05:22.738989 2026] [:error] [pid 13023:tid 13028] [client 85.203.15.4:52593] [client 85.203.15.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aeLm4v1e7hG8DAeABB9tMQAAAQM"]
[Sat Apr 18 10:05:23.829248 2026] [:error] [pid 9863:tid 9874] [client 85.203.15.20:29127] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aeLm4zjjiypiFrTucbJLbQAAAAE"]
[Sat Apr 18 10:05:25.804804 2026] [:error] [pid 9863:tid 9887] [client 81.199.26.71:27543] [client 81.199.26.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aeLm5TjjiypiFrTucbJLfwAAAA4"]
[Sat Apr 18 10:05:27.423951 2026] [:error] [pid 9970:tid 9975] [client 85.203.15.18:32205] [client 85.203.15.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aeLm5yYdRLRhVmaIMx0g2QAAAME"]
[Sat Apr 18 10:05:28.083063 2026] [proxy_fcgi:error] [pid 34288:tid 34306] [client 85.203.15.13:57163] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 10:05:28.408818 2026] [:error] [pid 34288:tid 34299] [client 85.203.15.13:57163] [client 85.203.15.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aeLm6OTIiy__PtiLmplv6wAAAYc"]
[Sat Apr 18 10:05:29.098625 2026] [:error] [pid 34288:tid 34298] [client 85.203.15.32:57309] [client 85.203.15.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aeLm6eTIiy__PtiLmplv7AAAAYY"]
[Sat Apr 18 10:05:30.389023 2026] [:error] [pid 9863:tid 9880] [client 81.199.26.84:34875] [client 81.199.26.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aeLm6jjjiypiFrTucbJLjgAAAAc"]
[Sat Apr 18 10:05:31.050510 2026] [:error] [pid 13023:tid 13034] [client 81.199.26.72:52243] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aeLm6_1e7hG8DAeABB9tNgAAAQk"]
[Sat Apr 18 10:05:33.661487 2026] [:error] [pid 13023:tid 13027] [client 85.203.15.13:43633] [client 85.203.15.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aeLm7f1e7hG8DAeABB9tSAAAAQI"]
[Sat Apr 18 10:05:34.309522 2026] [:error] [pid 9863:tid 9879] [client 85.203.15.2:22363] [client 85.203.15.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aeLm7jjjiypiFrTucbJLjwAAAAY"]
[Sat Apr 18 10:05:35.283591 2026] [:error] [pid 34288:tid 34303] [client 85.203.15.20:53095] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/log.php"] [unique_id "aeLm7-TIiy__PtiLmplv-QAAAYs"]
[Sat Apr 18 10:05:35.931123 2026] [:error] [pid 13023:tid 13034] [client 85.203.15.3:59151] [client 85.203.15.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aeLm7_1e7hG8DAeABB9tWwAAAQk"]
[Sat Apr 18 10:05:36.579317 2026] [:error] [pid 9863:tid 9897] [client 85.203.15.2:39455] [client 85.203.15.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aeLm8DjjiypiFrTucbJLkQAAABg"]
[Sat Apr 18 10:05:37.223294 2026] [:error] [pid 13023:tid 13040] [client 81.199.26.87:65449] [client 81.199.26.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/aw.php"] [unique_id "aeLm8f1e7hG8DAeABB9tZQAAAQ8"]
[Sat Apr 18 10:05:39.209486 2026] [:error] [pid 34237:tid 34241] [client 85.203.15.236:26343] [client 85.203.15.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aeLm8xBmX4Wq5a6rxfYSawAAAUI"]
[Sat Apr 18 10:05:39.858161 2026] [:error] [pid 9970:tid 9996] [client 85.203.15.237:38591] [client 85.203.15.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/install.php"] [unique_id "aeLm8yYdRLRhVmaIMx0g3QAAANY"]
[Sat Apr 18 10:05:41.178950 2026] [:error] [pid 34237:tid 34239] [client 85.203.15.242:63579] [client 85.203.15.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aeLm9RBmX4Wq5a6rxfYScAAAAUA"]
[Sat Apr 18 10:05:41.829328 2026] [:error] [pid 34290:tid 34341] [client 85.203.15.31:46655] [client 85.203.15.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aeLm9RqX6WpmmAXOBi-J6QAAAdY"]
[Sat Apr 18 10:05:43.124654 2026] [:error] [pid 9865:tid 9950] [client 85.203.15.245:51085] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/template-less.php"] [unique_id "aeLm96zb5knECIY-C-j2zwAAAI0"]
[Sat Apr 18 10:05:43.765348 2026] [:error] [pid 13023:tid 13038] [client 85.203.15.10:26943] [client 85.203.15.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aeLm9_1e7hG8DAeABB9tawAAAQ0"]
[Sat Apr 18 10:05:47.852788 2026] [:error] [pid 34288:tid 34302] [client 85.203.15.238:47553] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aeLm--TIiy__PtiLmplwDQAAAYo"]
[Sat Apr 18 10:05:48.501867 2026] [:error] [pid 9863:tid 9896] [client 85.203.15.25:41151] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aeLm_DjjiypiFrTucbJLtgAAABc"]
[Sat Apr 18 10:05:49.796316 2026] [:error] [pid 9863:tid 9878] [client 85.203.15.20:55147] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/file.php"] [unique_id "aeLm_TjjiypiFrTucbJLwgAAAAU"]
[Sat Apr 18 10:05:50.767232 2026] [:error] [pid 34290:tid 34330] [client 85.203.15.36:40571] [client 85.203.15.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aeLm_hqX6WpmmAXOBi-J7wAAAcs"]
[Sat Apr 18 10:05:51.741483 2026] [:error] [pid 9970:tid 9985] [client 85.203.15.20:53455] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/load.php"] [unique_id "aeLm_yYdRLRhVmaIMx0g5AAAAMs"]
[Sat Apr 18 10:05:52.391039 2026] [:error] [pid 34290:tid 34334] [client 85.203.15.245:57929] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aeLnABqX6WpmmAXOBi-J8wAAAc8"]
[Sat Apr 18 10:05:53.044615 2026] [:error] [pid 34290:tid 34331] [client 85.203.15.36:33511] [client 85.203.15.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aeLnARqX6WpmmAXOBi-J9gAAAcw"]
[Sat Apr 18 10:05:54.693655 2026] [:error] [pid 9864:tid 9925] [client 85.203.15.36:34413] [client 85.203.15.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aeLnAoCFeowknfXHM7lq2QAAAFM"]
[Sat Apr 18 10:05:55.670156 2026] [:error] [pid 9865:tid 9943] [client 85.203.15.238:65267] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aeLnA6zb5knECIY-C-j26gAAAIY"]
[Sat Apr 18 10:05:56.966133 2026] [:error] [pid 13023:tid 13045] [client 85.203.15.25:59871] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aeLnBP1e7hG8DAeABB9tiwAAARQ"]
[Sat Apr 18 10:05:57.611079 2026] [:error] [pid 34237:tid 34249] [client 85.203.15.32:52289] [client 85.203.15.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aeLnBRBmX4Wq5a6rxfYSggAAAUo"]
[Sat Apr 18 10:05:58.257106 2026] [:error] [pid 34290:tid 34323] [client 85.203.15.20:61437] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aeLnBhqX6WpmmAXOBi-J_AAAAcQ"]
[Sat Apr 18 10:06:01.557750 2026] [:error] [pid 9865:tid 9947] [client 81.199.26.76:33579] [client 81.199.26.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aeLnCazb5knECIY-C-j2_gAAAIo"]
[Sat Apr 18 10:06:02.584080 2026] [:error] [pid 9865:tid 9953] [client 85.203.15.32:49281] [client 85.203.15.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aeLnCqzb5knECIY-C-j3BAAAAJA"]
[Sat Apr 18 10:06:03.917977 2026] [:error] [pid 9865:tid 9957] [client 81.199.26.73:28035] [client 81.199.26.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aeLnC6zb5knECIY-C-j3CQAAAJQ"]
[Sat Apr 18 10:06:04.567542 2026] [:error] [pid 34237:tid 34259] [client 85.203.15.26:42351] [client 85.203.15.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aeLnDBBmX4Wq5a6rxfYSjQAAAVQ"]
[Sat Apr 18 10:06:05.219108 2026] [:error] [pid 34288:tid 34310] [client 81.199.26.88:38061] [client 81.199.26.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aeLnDeTIiy__PtiLmplwEAAAAZI"]
[Sat Apr 18 10:06:06.520114 2026] [:error] [pid 13023:tid 13048] [client 85.203.15.20:56039] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeLnDv1e7hG8DAeABB9toQAAARc"]
[Sat Apr 18 10:06:09.440193 2026] [:error] [pid 34290:tid 34337] [client 85.203.15.245:36667] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aeLnERqX6WpmmAXOBi-KDAAAAdI"]
[Sat Apr 18 10:06:11.419467 2026] [:error] [pid 9864:tid 9907] [client 85.203.15.239:46349] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aeLnE4CFeowknfXHM7lq7QAAAEI"]
[Sat Apr 18 10:06:12.717110 2026] [:error] [pid 9863:tid 9885] [client 81.199.26.81:58527] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aeLnFDjjiypiFrTucbJMIgAAAAw"]
[Sat Apr 18 10:06:13.363733 2026] [:error] [pid 9863:tid 9881] [client 81.199.26.79:40791] [client 81.199.26.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aeLnFTjjiypiFrTucbJMKgAAAAg"]
[Sat Apr 18 10:06:18.713830 2026] [:error] [pid 13023:tid 13028] [client 85.203.15.245:37467] [client 85.203.15.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aeLnGv1e7hG8DAeABB9tvgAAAQM"]
[Sat Apr 18 10:06:19.357586 2026] [:error] [pid 34237:tid 34245] [client 85.203.15.238:31409] [client 85.203.15.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aeLnGxBmX4Wq5a6rxfYSqQAAAUY"]
[Sat Apr 18 10:06:20.004706 2026] [:error] [pid 9970:tid 9986] [client 81.199.26.82:55627] [client 81.199.26.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aeLnHCYdRLRhVmaIMx0g9AAAAMw"]
[Sat Apr 18 10:06:20.982654 2026] [:error] [pid 34237:tid 34246] [client 81.199.26.81:43495] [client 81.199.26.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.199.26.81, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aeLnHBBmX4Wq5a6rxfYSqwAAAUc"]
[Sat Apr 18 10:06:21.643743 2026] [:error] [pid 34237:tid 34259] [client 81.199.26.81:43495] [client 81.199.26.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aeLnHRBmX4Wq5a6rxfYSrQAAAVQ"]
[Sat Apr 18 10:06:22.299077 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.242:22917] [client 85.203.15.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aeLnHv1e7hG8DAeABB9txgAAAQw"]
[Sat Apr 18 10:06:22.951465 2026] [:error] [pid 34237:tid 34242] [client 81.199.26.79:25741] [client 81.199.26.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aeLnHhBmX4Wq5a6rxfYSrgAAAUM"]
[Sat Apr 18 10:06:25.560481 2026] [:error] [pid 13023:tid 13038] [client 85.203.15.29:39701] [client 85.203.15.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aeLnIf1e7hG8DAeABB9t0AAAAQ0"]
[Sat Apr 18 10:06:28.539778 2026] [:error] [pid 9863:tid 9897] [client 81.199.26.75:23077] [client 81.199.26.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aeLnJDjjiypiFrTucbJMVQAAABg"]
[Sat Apr 18 10:06:29.845099 2026] [:error] [pid 34288:tid 34315] [client 85.203.15.20:46123] [client 85.203.15.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aeLnJeTIiy__PtiLmplwHwAAAZc"]
[Sat Apr 18 10:06:34.433862 2026] [:error] [pid 34290:tid 34343] [client 85.203.15.31:53217] [client 85.203.15.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aeLnKhqX6WpmmAXOBi-KQQAAAdg"]
[Sat Apr 18 10:06:35.087273 2026] [:error] [pid 34237:tid 34254] [client 85.203.15.25:61033] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aeLnKxBmX4Wq5a6rxfYStgAAAU8"]
[Sat Apr 18 10:06:35.750458 2026] [:error] [pid 9865:tid 9960] [client 85.203.15.39:60785] [client 85.203.15.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aeLnK6zb5knECIY-C-j3EgAAAJc"]
[Sat Apr 18 10:06:36.396157 2026] [:error] [pid 9970:tid 9997] [client 85.203.15.239:50815] [client 85.203.15.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aeLnLCYdRLRhVmaIMx0hDAAAANc"]
[Sat Apr 18 10:06:38.031182 2026] [:error] [pid 13023:tid 13029] [client 85.203.15.38:33993] [client 85.203.15.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aeLnLv1e7hG8DAeABB9t8gAAAQQ"]
[Sat Apr 18 10:06:38.683332 2026] [:error] [pid 13023:tid 13046] [client 85.203.15.26:21361] [client 85.203.15.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aeLnLv1e7hG8DAeABB9t-gAAARU"]
[Sat Apr 18 10:06:40.970739 2026] [:error] [pid 13023:tid 13044] [client 85.203.15.16:45679] [client 85.203.15.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aeLnMP1e7hG8DAeABB9uDQAAARM"]
[Sat Apr 18 10:06:42.930078 2026] [:error] [pid 13023:tid 13027] [client 81.199.26.72:38989] [client 81.199.26.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aeLnMv1e7hG8DAeABB9uFwAAAQI"]
[Sat Apr 18 10:06:43.578026 2026] [:error] [pid 13023:tid 13037] [client 85.203.15.25:60517] [client 85.203.15.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aeLnM_1e7hG8DAeABB9uHAAAAQw"]
[Sat Apr 18 10:07:13.202580 2026] [autoindex:error] [pid 9970:tid 9987] [client 81.199.26.72:36525] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 16:10:10.832683 2026] [:error] [pid 9864:tid 9919] [client 106.220.104.114:5155] [client 106.220.104.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.220.104.114, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeM8YoCFeowknfXHM7nGkgAAAE0"]
[Sat Apr 18 17:50:49.228128 2026] [:error] [pid 13023:tid 13031] [client 43.131.45.213:34814] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeNT-f1e7hG8DAeABB_kWAAAAQY"]
[Sat Apr 18 20:17:36.970089 2026] [:error] [pid 34290:tid 34336] [client 43.131.23.154:50700] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeN2YBqX6WpmmAXOBi8bWwAAAdE"]
[Sun Apr 19 01:01:03.295986 2026] [:error] [pid 60910:tid 60929] [client 43.157.179.227:53842] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeO4z3FWunkyacYqsD0cygAAAVE"]
[Sun Apr 19 03:17:05.218549 2026] [:error] [pid 32166:tid 32203] [client 45.132.115.88:20909] [client 45.132.115.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.88, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aePYsZCHNkWwdiZnafLdbwAAAEU"]
[Sun Apr 19 05:23:05.660726 2026] [:error] [pid 47773:tid 47835] [client 147.93.39.188:18430] [client 147.93.39.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/core/.env"] [unique_id "aeP2OeiBHdnCJDuPq9BMUAAAAFM"]
[Sun Apr 19 05:23:05.660730 2026] [:error] [pid 15760:tid 15782] [client 147.93.39.188:18436] [client 147.93.39.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aeP2OfSdD_XHQMJ_ISsXIQAAAc4"]
[Sun Apr 19 08:21:28.398556 2026] [:error] [pid 47772:tid 47795] [client 120.71.59.24:44868] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeQgCIc0L16cb4smAz_ZpwAAAAY"]
[Sun Apr 19 08:21:50.844044 2026] [:error] [pid 47775:tid 47847] [client 2.24.212.114:53586] [client 2.24.212.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeQgHrmztjlk9tsmoeyd_wAAAIQ"]
[Sun Apr 19 08:27:37.537684 2026] [:error] [pid 47772:tid 47810] [client 101.33.81.73:45052] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeQheYc0L16cb4smAz_cEwAAABU"]
[Sun Apr 19 11:35:33.414614 2026] [:error] [pid 15764:tid 15843] [client 170.106.72.178:53620] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeRNhWLL_sqdSHoVp-ROdAAAAlE"]
[Sun Apr 19 12:47:40.238740 2026] [:error] [pid 15764:tid 15841] [client 212.47.78.123:63970] [client 212.47.78.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeRebGLL_sqdSHoVp-RvvQAAAk8"]
[Sun Apr 19 12:47:40.817513 2026] [:error] [pid 47773:tid 47828] [client 212.47.78.123:63208] [client 212.47.78.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeRebOiBHdnCJDuPq9DqwQAAAEw"]
[Sun Apr 19 12:47:41.390174 2026] [:error] [pid 15764:tid 15838] [client 212.47.78.123:58481] [client 212.47.78.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "aeRebWLL_sqdSHoVp-RvwQAAAkw"]
[Sun Apr 19 13:00:51.379766 2026] [:error] [pid 47775:tid 47851] [client 93.123.109.79:56559] [client 93.123.109.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeRhg7mztjlk9tsmoezNYgAAAIg"]
[Sun Apr 19 13:04:00.937602 2026] [ssl:error] [pid 47772:tid 47794] [client 47.128.112.38:60592] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Sun Apr 19 13:45:15.726809 2026] [:error] [pid 47773:tid 47837] [client 8.229.224.4:60634] [client 8.229.224.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aeRr6-iBHdnCJDuPq9Dz4QAAAFU"]
[Sun Apr 19 14:42:22.843380 2026] [:error] [pid 15694:tid 15738] [client 106.119.167.146:50071] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeR5TrimB-jol1fwqAroggAAAYw"]
[Sun Apr 19 14:47:24.180032 2026] [:error] [pid 47772:tid 47792] [client 170.106.35.137:56674] [client 170.106.35.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeR6fIc0L16cb4smAz9UXwAAAAM"]
[Sun Apr 19 14:59:27.206337 2026] [:error] [pid 15763:tid 15806] [client 180.251.200.75:55045] [client 180.251.200.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.251.200.75, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeR9T7MXv1Y1THOoxaCm2AAAAgo"]
[Sun Apr 19 17:36:10.214864 2026] [:error] [pid 47775:tid 47855] [client 170.106.187.106:44624] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeSiCrmztjlk9tsmoezxhgAAAIw"]
[Sun Apr 19 19:13:09.693415 2026] [:error] [pid 47772:tid 47799] [client 213.35.109.170:52515] [client 213.35.109.170] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:auth outside range: 1-255. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||paramountestate.com|F|3"] [data "ARGS:auth=\\x00"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-automatic/inc/csv.php"] [unique_id "aeS4xYc0L16cb4smAz-ShwAAAAo"]
[Sun Apr 19 19:29:34.145119 2026] [:error] [pid 47775:tid 47852] [client 192.99.71.37:35654] [client 192.99.71.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aeS8nrmztjlk9tsmoewChAAAAIk"]
[Sun Apr 19 20:15:19.207512 2026] [:error] [pid 47772:tid 47794] [client 43.133.66.51:36068] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeTHV4c0L16cb4smAz-ldwAAAAU"]
[Sun Apr 19 21:19:54.527550 2026] [:error] [pid 47773:tid 47823] [client 114.96.103.33:50190] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeTWeuiBHdnCJDuPq9BCggAAAEc"]
[Sun Apr 19 22:04:15.248023 2026] [:error] [pid 47772:tid 47799] [client 138.68.5.226:58502] [client 138.68.5.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeTg34c0L16cb4smAz_K_QAAAAo"]
[Sun Apr 19 22:17:26.282818 2026] [:error] [pid 15760:tid 15783] [client 172.213.245.217:34054] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeTj9vSdD_XHQMJ_IStMjgAAAc8"]
[Sun Apr 19 22:17:34.153272 2026] [:error] [pid 47773:tid 47838] [client 172.213.245.217:13647] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws80.php"] [unique_id "aeTj_uiBHdnCJDuPq9BPMwAAAFY"]
[Sun Apr 19 22:17:36.746441 2026] [:error] [pid 47886:tid 47903] [client 172.213.245.217:13669] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws80.php"] [unique_id "aeTkAESe8yiyuPrD7yOAwQAAAM8"]
[Sun Apr 19 22:17:38.389021 2026] [:error] [pid 47772:tid 47804] [client 172.213.245.217:30099] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws80.php"] [unique_id "aeTkAoc0L16cb4smAz_PLAAAAA8"]
[Sun Apr 19 22:17:40.339411 2026] [:error] [pid 15693:tid 15714] [client 172.213.245.217:39430] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws80.php"] [unique_id "aeTkBMNMD-ccazQlTslgiwAAAVI"]
[Sun Apr 19 22:17:41.716456 2026] [:error] [pid 47772:tid 47792] [client 172.213.245.217:15494] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeTkBYc0L16cb4smAz_PPAAAAAM"]
[Sun Apr 19 22:17:43.212049 2026] [:error] [pid 47772:tid 47804] [client 172.213.245.217:33653] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeTkB4c0L16cb4smAz_PPwAAAA8"]
[Sun Apr 19 22:17:45.048195 2026] [:error] [pid 47775:tid 47851] [client 172.213.245.217:45051] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeTkCbmztjlk9tsmoewgGwAAAIg"]
[Sun Apr 19 22:17:46.425331 2026] [:error] [pid 15765:tid 15864] [client 172.213.245.217:44993] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeTkCvRqinw-W5EwQ74DgQAAAos"]
[Sun Apr 19 22:17:48.900370 2026] [:error] [pid 15760:tid 15782] [client 172.213.245.217:39482] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeTkDPSdD_XHQMJ_IStMuQAAAc4"]
[Sun Apr 19 22:17:50.170954 2026] [:error] [pid 47886:tid 47909] [client 172.213.245.217:26866] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeTkDkSe8yiyuPrD7yOAxAAAANU"]
[Sun Apr 19 22:17:51.603501 2026] [:error] [pid 47886:tid 47888] [client 172.213.245.217:23377] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeTkD0Se8yiyuPrD7yOAxwAAAMA"]
[Sun Apr 19 22:17:54.096666 2026] [:error] [pid 15760:tid 15789] [client 172.213.245.217:27263] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeTkEvSdD_XHQMJ_IStMwwAAAdU"]
[Sun Apr 19 22:17:56.487489 2026] [:error] [pid 15760:tid 15788] [client 172.213.245.217:24933] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8.php"] [unique_id "aeTkFPSdD_XHQMJ_IStMzQAAAdQ"]
[Sun Apr 19 22:17:58.869479 2026] [:error] [pid 15760:tid 15786] [client 172.213.245.217:35200] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8.php"] [unique_id "aeTkFvSdD_XHQMJ_IStM2QAAAdI"]
[Sun Apr 19 22:18:01.253545 2026] [:error] [pid 15760:tid 15792] [client 172.213.245.217:35245] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8.php"] [unique_id "aeTkGfSdD_XHQMJ_IStM4gAAAdg"]
[Sun Apr 19 22:18:02.807037 2026] [:error] [pid 15765:tid 15870] [client 172.213.245.217:27245] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8.php"] [unique_id "aeTkGvRqinw-W5EwQ74DmgAAApE"]
[Sun Apr 19 22:18:04.290372 2026] [:error] [pid 15763:tid 15809] [client 172.213.245.217:35248] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "aeTkHLMXv1Y1THOoxaAI6AAAAg0"]
[Sun Apr 19 22:18:05.709447 2026] [:error] [pid 47773:tid 47834] [client 172.213.245.217:35232] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "aeTkHeiBHdnCJDuPq9BPRgAAAFI"]
[Sun Apr 19 22:18:07.240733 2026] [:error] [pid 47773:tid 47837] [client 172.213.245.217:39446] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "aeTkH-iBHdnCJDuPq9BPSQAAAFU"]
[Sun Apr 19 22:18:08.596626 2026] [:error] [pid 47772:tid 47790] [client 172.213.245.217:45025] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jga.php"] [unique_id "aeTkIIc0L16cb4smAz_PWgAAAAE"]
[Sun Apr 19 22:18:09.934378 2026] [:error] [pid 15760:tid 15784] [client 172.213.245.217:1625] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/users.php"] [unique_id "aeTkIfSdD_XHQMJ_IStM9AAAAdA"]
[Sun Apr 19 22:18:11.385382 2026] [:error] [pid 15765:tid 15852] [client 172.213.245.217:1617] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/users.php"] [unique_id "aeTkI_Rqinw-W5EwQ74DngAAAoA"]
[Sun Apr 19 22:18:12.830068 2026] [:error] [pid 47772:tid 47810] [client 172.213.245.217:20990] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/users.php"] [unique_id "aeTkJIc0L16cb4smAz_PWwAAABU"]
[Sun Apr 19 22:18:14.650391 2026] [:error] [pid 15764:tid 15835] [client 172.213.245.217:1668] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/network/users.php"] [unique_id "aeTkJmLL_sqdSHoVp-QtQAAAAkk"]
[Sun Apr 19 22:18:16.417305 2026] [:error] [pid 15764:tid 15839] [client 172.213.245.217:32506] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an.php"] [unique_id "aeTkKGLL_sqdSHoVp-QtRAAAAk0"]
[Sun Apr 19 22:18:18.098515 2026] [:error] [pid 15764:tid 15830] [client 172.213.245.217:1285] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an.php"] [unique_id "aeTkKmLL_sqdSHoVp-QtRgAAAkQ"]
[Sun Apr 19 22:18:19.181807 2026] [:error] [pid 15760:tid 15772] [client 172.213.245.217:35286] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an.php"] [unique_id "aeTkK_SdD_XHQMJ_IStNAQAAAcQ"]
[Sun Apr 19 22:18:20.300916 2026] [:error] [pid 15760:tid 15783] [client 172.213.245.217:1308] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/an.php"] [unique_id "aeTkLPSdD_XHQMJ_IStNBwAAAc8"]
[Sun Apr 19 22:18:21.670007 2026] [:error] [pid 15760:tid 15769] [client 172.213.245.217:14066] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-header.php"] [unique_id "aeTkLfSdD_XHQMJ_IStNDQAAAcE"]
[Sun Apr 19 22:18:22.717636 2026] [:error] [pid 15760:tid 15784] [client 172.213.245.217:1656] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-header.php"] [unique_id "aeTkLvSdD_XHQMJ_IStNEgAAAdA"]
[Sun Apr 19 22:18:24.975504 2026] [:error] [pid 15760:tid 15775] [client 172.213.245.217:1629] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-header.php"] [unique_id "aeTkMPSdD_XHQMJ_IStNGgAAAcc"]
[Sun Apr 19 22:18:26.692806 2026] [:error] [pid 15764:tid 15846] [client 172.213.245.217:35319] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blog-header.php"] [unique_id "aeTkMmLL_sqdSHoVp-QtUAAAAlQ"]
[Sun Apr 19 22:18:28.709142 2026] [:error] [pid 47775:tid 47853] [client 172.213.245.217:1608] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aeTkNLmztjlk9tsmoewgqAAAAIo"]
[Sun Apr 19 22:18:30.125535 2026] [:error] [pid 15760:tid 15776] [client 172.213.245.217:15517] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aeTkNvSdD_XHQMJ_IStNJQAAAcg"]
[Sun Apr 19 22:18:49.260727 2026] [:error] [pid 47772:tid 47805] [client 172.213.245.217:22861] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admlo.php"] [unique_id "aeTkSYc0L16cb4smAz_PlQAAABA"]
[Sun Apr 19 22:18:53.331048 2026] [:error] [pid 47772:tid 47799] [client 172.213.245.217:32844] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admlo.php"] [unique_id "aeTkTYc0L16cb4smAz_PmQAAAAo"]
[Sun Apr 19 22:18:57.749973 2026] [:error] [pid 15764:tid 15851] [client 172.213.245.217:30491] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admlo.php"] [unique_id "aeTkUWLL_sqdSHoVp-QtigAAAlg"]
[Sun Apr 19 22:19:06.960093 2026] [:error] [pid 47886:tid 47905] [client 172.213.245.217:30500] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "aeTkWkSe8yiyuPrD7yOA8wAAANE"]
[Sun Apr 19 22:19:10.928745 2026] [:error] [pid 47772:tid 47793] [client 172.213.245.217:16674] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "aeTkXoc0L16cb4smAz_PtgAAAAQ"]
[Sun Apr 19 22:19:15.528682 2026] [:error] [pid 15764:tid 15829] [client 172.213.245.217:28011] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/t.php"] [unique_id "aeTkY2LL_sqdSHoVp-Qt1AAAAkM"]
[Sun Apr 19 22:19:20.551586 2026] [:error] [pid 15760:tid 15773] [client 172.213.245.217:25899] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "aeTkaPSdD_XHQMJ_IStNeQAAAcU"]
[Sun Apr 19 22:19:22.001550 2026] [:error] [pid 15694:tid 15740] [client 172.213.245.217:18944] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "aeTkarimB-jol1fwqAoUmwAAAY4"]
[Sun Apr 19 22:19:24.047669 2026] [:error] [pid 15760:tid 15779] [client 172.213.245.217:27983] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "aeTkbPSdD_XHQMJ_IStNgwAAAcs"]
[Sun Apr 19 22:19:25.441305 2026] [:error] [pid 47775:tid 47867] [client 172.213.245.217:30167] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/lib.php"] [unique_id "aeTkbbmztjlk9tsmoewg8AAAAJg"]
[Sun Apr 19 22:19:26.907246 2026] [:error] [pid 47773:tid 47819] [client 172.213.245.217:1909] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kj.php"] [unique_id "aeTkbuiBHdnCJDuPq9BPpAAAAEM"]
[Sun Apr 19 22:19:28.677760 2026] [:error] [pid 47886:tid 47903] [client 172.213.245.217:28026] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kj.php"] [unique_id "aeTkcESe8yiyuPrD7yOBEgAAAM8"]
[Sun Apr 19 22:19:30.300877 2026] [:error] [pid 15763:tid 15806] [client 172.213.245.217:27985] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kj.php"] [unique_id "aeTkcrMXv1Y1THOoxaAJHgAAAgo"]
[Sun Apr 19 22:19:31.448715 2026] [:error] [pid 15764:tid 15847] [client 172.213.245.217:22072] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/kj.php"] [unique_id "aeTkc2LL_sqdSHoVp-Qt5wAAAlU"]
[Sun Apr 19 22:19:32.428707 2026] [:error] [pid 47772:tid 47801] [client 172.213.245.217:22050] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/new.php"] [unique_id "aeTkdIc0L16cb4smAz_PwgAAAAw"]
[Sun Apr 19 22:19:34.138129 2026] [:error] [pid 15763:tid 15799] [client 172.213.245.217:16701] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/new.php"] [unique_id "aeTkdrMXv1Y1THOoxaAJJQAAAgM"]
[Sun Apr 19 22:19:34.893885 2026] [:error] [pid 15763:tid 15808] [client 172.213.245.217:30186] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/new.php"] [unique_id "aeTkdrMXv1Y1THOoxaAJKgAAAgw"]
[Sun Apr 19 22:19:36.510137 2026] [:error] [pid 15760:tid 15785] [client 172.213.245.217:21339] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/new.php"] [unique_id "aeTkePSdD_XHQMJ_IStNogAAAdE"]
[Sun Apr 19 22:19:41.287661 2026] [:error] [pid 15760:tid 15781] [client 172.213.245.217:21351] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "aeTkffSdD_XHQMJ_IStNyAAAAc0"]
[Sun Apr 19 22:19:42.796962 2026] [:error] [pid 47772:tid 47801] [client 172.213.245.217:20122] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "aeTkfoc0L16cb4smAz_PywAAAAw"]
[Sun Apr 19 22:19:44.859895 2026] [:error] [pid 47775:tid 47857] [client 172.213.245.217:38718] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "aeTkgLmztjlk9tsmoewg9gAAAI4"]
[Sun Apr 19 22:19:45.978421 2026] [:error] [pid 15764:tid 15832] [client 172.213.245.217:16666] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tool.php"] [unique_id "aeTkgWLL_sqdSHoVp-Qt9wAAAkY"]
[Sun Apr 19 22:19:47.154013 2026] [:error] [pid 15764:tid 15838] [client 172.213.245.217:16672] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "aeTkg2LL_sqdSHoVp-Qt-wAAAkw"]
[Sun Apr 19 22:19:48.545751 2026] [:error] [pid 47772:tid 47790] [client 172.213.245.217:12867] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "aeTkhIc0L16cb4smAz_P1wAAAAE"]
[Sun Apr 19 22:19:49.667340 2026] [:error] [pid 47772:tid 47801] [client 172.213.245.217:34869] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "aeTkhYc0L16cb4smAz_P3gAAAAw"]
[Sun Apr 19 22:19:51.065736 2026] [:error] [pid 47772:tid 47790] [client 172.213.245.217:12882] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-blogs.php"] [unique_id "aeTkh4c0L16cb4smAz_P5QAAAAE"]
[Sun Apr 19 22:19:52.802443 2026] [:error] [pid 15763:tid 15799] [client 172.213.245.217:38681] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "aeTkiLMXv1Y1THOoxaAJNgAAAgM"]
[Sun Apr 19 22:19:54.570675 2026] [:error] [pid 15763:tid 15811] [client 172.213.245.217:34849] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "aeTkirMXv1Y1THOoxaAJPAAAAg8"]
[Sun Apr 19 22:19:56.536567 2026] [:error] [pid 15765:tid 15865] [client 172.213.245.217:25638] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "aeTkjPRqinw-W5EwQ74DwwAAAow"]
[Sun Apr 19 22:19:59.631914 2026] [:error] [pid 15760:tid 15768] [client 172.213.245.217:12905] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bgymj.php"] [unique_id "aeTkj_SdD_XHQMJ_IStN3QAAAcA"]
[Sun Apr 19 22:20:01.293140 2026] [:error] [pid 47773:tid 47839] [client 172.213.245.217:21352] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "aeTkkeiBHdnCJDuPq9BPuAAAAFc"]
[Sun Apr 19 22:20:02.634295 2026] [:error] [pid 15760:tid 15778] [client 172.213.245.217:20149] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "aeTkkvSdD_XHQMJ_IStN7QAAAco"]
[Sun Apr 19 22:20:03.508961 2026] [:error] [pid 15765:tid 15855] [client 172.213.245.217:27530] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "aeTkk_Rqinw-W5EwQ74DygAAAoI"]
[Sun Apr 19 22:20:04.616789 2026] [:error] [pid 15760:tid 15790] [client 172.213.245.217:20116] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "aeTklPSdD_XHQMJ_IStN-wAAAdY"]
[Sun Apr 19 22:20:06.976981 2026] [:error] [pid 15765:tid 15875] [client 172.213.245.217:21335] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "aeTklvRqinw-W5EwQ74DzAAAApY"]
[Sun Apr 19 22:20:08.082326 2026] [:error] [pid 15760:tid 15768] [client 172.213.245.217:25659] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "aeTkmPSdD_XHQMJ_IStOAQAAAcA"]
[Sun Apr 19 22:20:10.033307 2026] [:error] [pid 15760:tid 15770] [client 172.213.245.217:34855] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "aeTkmvSdD_XHQMJ_IStOBgAAAcI"]
[Sun Apr 19 22:20:11.917194 2026] [:error] [pid 15760:tid 15787] [client 172.213.245.217:21368] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/amax.php"] [unique_id "aeTkm_SdD_XHQMJ_IStOCwAAAdM"]
[Sun Apr 19 22:20:14.533457 2026] [:error] [pid 15760:tid 15774] [client 172.213.245.217:38658] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "aeTknvSdD_XHQMJ_IStODgAAAcY"]
[Sun Apr 19 22:20:20.069563 2026] [:error] [pid 15764:tid 15834] [client 172.213.245.217:38683] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "aeTkpGLL_sqdSHoVp-QuEgAAAkg"]
[Sun Apr 19 22:20:22.871665 2026] [:error] [pid 15764:tid 15838] [client 172.213.245.217:20129] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "aeTkpmLL_sqdSHoVp-QuHgAAAkw"]
[Sun Apr 19 22:20:24.362278 2026] [:error] [pid 47773:tid 47836] [client 172.213.245.217:20140] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/mh.php"] [unique_id "aeTkqOiBHdnCJDuPq9BP1wAAAFQ"]
[Sun Apr 19 22:20:28.079618 2026] [:error] [pid 15763:tid 15810] [client 172.213.245.217:21369] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "aeTkrLMXv1Y1THOoxaAJUwAAAg4"]
[Sun Apr 19 22:20:29.669710 2026] [:error] [pid 15693:tid 15700] [client 172.213.245.217:20124] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "aeTkrcNMD-ccazQlTslgvAAAAUQ"]
[Sun Apr 19 22:20:31.085244 2026] [:error] [pid 15764:tid 15830] [client 172.213.245.217:34868] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "aeTkr2LL_sqdSHoVp-QuKwAAAkQ"]
[Sun Apr 19 22:20:32.567851 2026] [:error] [pid 15765:tid 15859] [client 172.213.245.217:25653] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms.php"] [unique_id "aeTksPRqinw-W5EwQ74D4AAAAoY"]
[Sun Apr 19 22:20:35.643680 2026] [:error] [pid 15760:tid 15788] [client 172.213.245.217:20142] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "aeTks_SdD_XHQMJ_IStOaQAAAdQ"]
[Sun Apr 19 22:20:37.916039 2026] [:error] [pid 47772:tid 47792] [client 172.213.245.217:25663] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "aeTktYc0L16cb4smAz_QDAAAAAM"]
[Sun Apr 19 22:20:40.004951 2026] [:error] [pid 47773:tid 47839] [client 172.213.245.217:1858] [client 172.213.245.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/166.php"] [unique_id "aeTkuOiBHdnCJDuPq9BP6wAAAFc"]
[Sun Apr 19 22:23:06.341841 2026] [:error] [pid 15760:tid 15777] [client 172.213.245.217:25338] [client 172.213.245.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aeTlSvSdD_XHQMJ_IStQBwAAAck"]
[Sun Apr 19 22:45:20.412998 2026] [:error] [pid 47772:tid 47792] [client 43.135.140.225:55136] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeTqgIc0L16cb4smAz_YagAAAAM"]
[Sun Apr 19 22:50:48.028793 2026] [:error] [pid 47772:tid 47811] [client 146.70.194.222:43692] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeTryIc0L16cb4smAz_aGgAAABY"]
[Sun Apr 19 22:50:48.559322 2026] [:error] [pid 47775:tid 47850] [client 146.70.194.222:44018] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeTryLmztjlk9tsmoewndAAAAIc"]
[Sun Apr 19 22:50:49.073492 2026] [:error] [pid 15694:tid 15736] [client 146.70.194.222:44504] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aeTrybimB-jol1fwqAoYhgAAAYo"]
[Mon Apr 20 03:33:45.199081 2026] [:error] [pid 64334:tid 64413] [client 182.44.8.254:39337] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeUuGcNh9IxxDqsrPyNeEgAAAIo"]
[Mon Apr 20 04:09:58.849855 2026] [:error] [pid 64333:tid 64380] [client 43.130.110.130:42856] [client 43.130.110.130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeU2lnZav9wH8wxMd_slOwAAAEQ"]
[Mon Apr 20 09:43:19.553116 2026] [:error] [pid 64332:tid 64355] [client 43.154.127.188:52986] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeWEt8AQ57uMKAVSYElLAAAAAA0"]
[Mon Apr 20 12:24:44.870320 2026] [:error] [pid 11352:tid 11417] [client 49.51.252.146:51624] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeWqjGl10mhMSfJ7ir9fSgAAAIM"]
[Mon Apr 20 13:35:51.512538 2026] [:error] [pid 42014:tid 42023] [client 103.65.237.216:60419] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "aeW7N8ek-00-ZI0f1NrwOgAAAQc"]
[Mon Apr 20 13:35:51.770844 2026] [:error] [pid 11441:tid 11452] [client 103.65.237.216:60478] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.vscode/sftp.json"] [unique_id "aeW7N8ixByFUvmh319D3mAAAAMk"]
[Mon Apr 20 13:51:37.845073 2026] [:error] [pid 11351:tid 11410] [client 122.162.150.121:15463] [client 122.162.150.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.162.150.121, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeW-6QN8Z1-vktaI_tOKxgAAAFc"]
[Mon Apr 20 15:05:53.955191 2026] [:error] [pid 11351:tid 11388] [client 43.157.174.69:54352] [client 43.157.174.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeXQUQN8Z1-vktaI_tOYEAAAAEE"]
[Mon Apr 20 15:56:38.063140 2026] [:error] [pid 6928:tid 6943] [client 203.2.64.59:60276] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeXcNh3y7MHq1iB0qYpH2QAAAU0"]
[Mon Apr 20 17:48:01.843467 2026] [:error] [pid 6928:tid 6943] [client 43.157.181.189:57562] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeX2UR3y7MHq1iB0qYp-bAAAAU0"]
[Mon Apr 20 20:18:14.638161 2026] [:error] [pid 11351:tid 11390] [client 49.51.50.147:60718] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeYZhgN8Z1-vktaI_tP1jAAAAEM"]
[Mon Apr 20 22:06:23.676904 2026] [:error] [pid 42014:tid 42036] [client 46.101.161.93:52830] [client 46.101.161.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.161.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aeYy38ek-00-ZI0f1NqJ-gAAARQ"]
[Mon Apr 20 22:06:24.708726 2026] [:error] [pid 11351:tid 11408] [client 46.101.161.93:53015] [client 46.101.161.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.161.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aeYy4AN8Z1-vktaI_tMehQAAAFU"]
[Mon Apr 20 22:46:03.118724 2026] [:error] [pid 11351:tid 11404] [client 43.157.170.13:60068] [client 43.157.170.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeY8KwN8Z1-vktaI_tMzSwAAAFE"]
[Mon Apr 20 23:34:44.843623 2026] [:error] [pid 11350:tid 11383] [client 179.48.33.253:8279] [client 179.48.33.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.48.33.253, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeZHlP4EoMBgOJuJnT3y_QAAABg"]
[Tue Apr 21 01:04:25.931543 2026] [:error] [pid 11350:tid 11367] [client 45.131.195.174:45937] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeZcmf4EoMBgOJuJnT0ZzgAAAAg"]
[Tue Apr 21 04:00:22.415601 2026] [:error] [pid 4777:tid 4789] [client 185.194.178.41:44733] [client 185.194.178.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.41, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aeaF1qxXur6bykKyLZT9aAAAAQE"]
[Tue Apr 21 04:16:35.758890 2026] [:error] [pid 35415:tid 35451] [client 114.80.36.40:52350] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeaJo0iqDinI4_22zzjnvAAAANg"]
[Tue Apr 21 05:39:12.939192 2026] [:error] [pid 35415:tid 35445] [client 67.169.48.172:62957] [client 67.169.48.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.169.48.172, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeadAEiqDinI4_22zzj3lgAAANI"]
[Tue Apr 21 11:05:55.965030 2026] [:error] [pid 4823:tid 4855] [client 43.135.144.81:41404] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aebpk_c8mke3PfHqsxEfUQAAAYI"]
[Tue Apr 21 14:10:38.012954 2026] [:error] [pid 5377:tid 5400] [client 43.153.215.224:40590] [client 43.153.215.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aecU3rBKychFlrHBdvuqHgAAAc4"]
[Tue Apr 21 15:37:00.676815 2026] [:error] [pid 53731:tid 53755] [client 45.86.200.231:44045] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "aecpHF2I9THUR-bRVGzaSgAAAhM"]
[Tue Apr 21 15:37:01.503569 2026] [:error] [pid 4823:tid 4867] [client 45.86.200.231:30583] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aecpHfc8mke3PfHqsxG5XQAAAY4"]
[Tue Apr 21 15:37:03.434666 2026] [:error] [pid 35415:tid 35433] [client 45.86.200.234:52167] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "aecpH0iqDinI4_22zzhWFQAAAMY"]
[Tue Apr 21 15:37:06.080710 2026] [:error] [pid 35321:tid 35400] [client 185.82.72.179:45245] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aecpIjeHLhVUuu8cVXypJAAAAFA"]
[Tue Apr 21 15:37:08.555285 2026] [:error] [pid 5377:tid 5405] [client 45.86.200.237:28717] [client 45.86.200.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bk.php"] [unique_id "aecpJLBKychFlrHBdvvkNQAAAdM"]
[Tue Apr 21 15:37:32.159395 2026] [:error] [pid 53832:tid 53855] [client 213.35.109.170:56016] [client 213.35.109.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file-manager/initialize"] [unique_id "aecpPNzkuxsE_OhM9UIWtQAAAlQ"]
[Tue Apr 21 15:37:32.361137 2026] [:error] [pid 35321:tid 35403] [client 213.35.109.170:60460] [client 213.35.109.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file-manager/initialize"] [unique_id "aecpPDeHLhVUuu8cVXyr1AAAAFM"]
[Tue Apr 21 15:37:43.222683 2026] [:error] [pid 53832:tid 53853] [client 45.86.200.226:53257] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/execute.php"] [unique_id "aecpR9zkuxsE_OhM9UIXhgAAAlI"]
[Tue Apr 21 15:37:51.887736 2026] [:error] [pid 4823:tid 4875] [client 45.86.200.217:32499] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aecpT_c8mke3PfHqsxG64QAAAZY"]
[Tue Apr 21 15:37:52.423335 2026] [:error] [pid 53978:tid 53994] [client 45.86.200.222:42203] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aecpUJ1ivsR4hcOSQbax-wAAAo4"]
[Tue Apr 21 15:37:53.273034 2026] [:error] [pid 35320:tid 35345] [client 45.86.200.229:23087] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aecpUYJW6fdXWO6agMEc_wAAAA8"]
[Tue Apr 21 15:37:53.835790 2026] [:error] [pid 35322:tid 35371] [client 185.82.72.108:54009] [client 185.82.72.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aecpUaPoAfV40BTfVKzDVwAAAI4"]
[Tue Apr 21 15:37:54.685619 2026] [:error] [pid 53832:tid 53836] [client 45.86.200.226:32285] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aecpUtzkuxsE_OhM9UIYDgAAAkE"]
[Tue Apr 21 15:38:23.284046 2026] [:error] [pid 4823:tid 4863] [client 45.86.200.251:53523] [client 45.86.200.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-links.php/wp-content/plugins/wp-content/uploa/"] [unique_id "aecpb_c8mke3PfHqsxG8rwAAAYo"]
[Tue Apr 21 16:44:57.924439 2026] [:error] [pid 35322:tid 35375] [client 182.42.105.85:56546] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aec5CaPoAfV40BTfVKzL6AAAAJI"]
[Tue Apr 21 16:45:31.958857 2026] [:error] [pid 53978:tid 53984] [client 188.166.41.136:59164] [client 188.166.41.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.41.136, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aec5K51ivsR4hcOSQbbE-gAAAoQ"]
[Tue Apr 21 16:45:33.005725 2026] [:error] [pid 53978:tid 53988] [client 188.166.41.136:64232] [client 188.166.41.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.41.136, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aec5LZ1ivsR4hcOSQbbFBgAAAog"]
[Tue Apr 21 16:56:40.722645 2026] [:error] [pid 53731:tid 53745] [client 160.30.179.124:33718] [client 160.30.179.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aec7yF2I9THUR-bRVGzzHgAAAgo"]
[Tue Apr 21 17:29:50.024837 2026] [:error] [pid 54080:tid 54091] [client 103.255.134.61:38402] [client 103.255.134.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.255.134.61, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aedDjozEbQHHxtmWbaaGKAAAAsk"]
[Tue Apr 21 17:29:50.805367 2026] [:error] [pid 53731:tid 53749] [client 103.255.134.61:38410] [client 103.255.134.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.134.61, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aedDjl2I9THUR-bRVGwRlAAAAg4"]
[Tue Apr 21 20:03:19.449414 2026] [:error] [pid 53978:tid 54001] [client 159.89.117.170:59742] [client 159.89.117.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.117.170, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aednh51ivsR4hcOSQbYRBAAAApU"]
[Tue Apr 21 20:03:20.296380 2026] [:error] [pid 53832:tid 53849] [client 159.89.117.170:59844] [client 159.89.117.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.117.170, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aedniNzkuxsE_OhM9UJjVQAAAk4"]
[Tue Apr 21 20:20:57.912494 2026] [:error] [pid 35321:tid 35391] [client 43.130.26.3:43890] [client 43.130.26.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aedrqTeHLhVUuu8cVXyBXQAAAEc"]
[Tue Apr 21 22:35:43.768474 2026] [:error] [pid 53978:tid 53997] [client 103.216.221.96:1354] [client 103.216.221.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.96, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeeLP51ivsR4hcOSQbY8QwAAApE"]
[Tue Apr 21 22:48:12.754840 2026] [:error] [pid 35415:tid 35451] [client 43.154.140.188:33266] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeeOLEiqDinI4_22zzh-BQAAANg"]
[Tue Apr 21 22:53:35.201922 2026] [:error] [pid 35320:tid 35342] [client 20.216.148.29:17174] [client 20.216.148.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "aeePb4JW6fdXWO6agMEClAAAAAw"]
[Tue Apr 21 22:53:53.452352 2026] [:error] [pid 35320:tid 35335] [client 20.216.148.29:20582] [client 20.216.148.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeePgYJW6fdXWO6agMEC4wAAAAU"]
[Tue Apr 21 23:16:09.633834 2026] [:error] [pid 53731:tid 53748] [client 122.51.236.174:52608] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeeUuV2I9THUR-bRVGyeUgAAAg0"]
[Tue Apr 21 23:40:14.932231 2026] [:error] [pid 53978:tid 53992] [client 158.158.50.41:56448] [client 158.158.50.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeeaXp1ivsR4hcOSQbZU-gAAAow"]
[Wed Apr 22 01:20:09.265901 2026] [:error] [pid 54080:tid 54088] [client 49.51.183.15:44942] [client 49.51.183.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeexyYzEbQHHxtmWbab5YQAAAsY"]
[Wed Apr 22 04:12:06.229153 2026] [:error] [pid 23041:tid 23045] [client 163.7.2.30:45616] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/web.config"] [unique_id "aefaFkTXx_lUa7xwAb57hwAAAQE"]
[Wed Apr 22 04:12:16.307715 2026] [:error] [pid 21788:tid 21812] [client 163.7.2.30:52784] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".config"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/app.config"] [unique_id "aefaIH7OM27rzVpef249aQAAANY"]
[Wed Apr 22 04:20:48.080457 2026] [:error] [pid 21683:tid 21762] [client 163.7.2.30:35994] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aefcIFZBWT-0diZyYyZdwwAAAIw"]
[Wed Apr 22 04:29:08.098506 2026] [:error] [pid 21683:tid 21757] [client 43.156.28.204:49722] [client 43.156.28.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aefeFFZBWT-0diZyYyZhVQAAAIc"]
[Wed Apr 22 07:11:06.013795 2026] [:error] [pid 21683:tid 21750] [client 43.153.85.46:37620] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aegEClZBWT-0diZyYyaaHgAAAIA"]
[Wed Apr 22 09:46:07.970802 2026] [:error] [pid 21682:tid 21736] [client 185.192.71.235:50647] [client 185.192.71.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aegoX5lXWQZUlmPHS3o52wAAAE0"]
[Wed Apr 22 09:46:09.343763 2026] [:error] [pid 31755:tid 31780] [client 185.192.71.229:64815] [client 185.192.71.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aegoYQz2mYMkg3X8q1u9kAAAAhE"]
[Wed Apr 22 09:46:11.574182 2026] [:error] [pid 21682:tid 21729] [client 91.230.225.176:58631] [client 91.230.225.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aegoY5lXWQZUlmPHS3o57gAAAEY"]
[Wed Apr 22 09:46:12.966175 2026] [:error] [pid 31756:tid 31793] [client 91.230.225.168:23069] [client 91.230.225.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "aegoZN_WbkXbHaEfhd3_eAAAAkM"]
[Wed Apr 22 09:46:15.185019 2026] [:error] [pid 31755:tid 31776] [client 185.92.25.101:50597] [client 185.92.25.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aegoZwz2mYMkg3X8q1u98wAAAg0"]
[Wed Apr 22 09:46:16.001669 2026] [:error] [pid 23041:tid 23047] [client 91.230.225.175:42643] [client 91.230.225.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aegoaETXx_lUa7xwAb4zzwAAAQM"]
[Wed Apr 22 09:46:16.561649 2026] [:error] [pid 31755:tid 31776] [client 185.92.25.100:54393] [client 185.92.25.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aegoaAz2mYMkg3X8q1u-AgAAAg0"]
[Wed Apr 22 09:46:17.111374 2026] [:error] [pid 31755:tid 31764] [client 185.192.71.244:29503] [client 185.192.71.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aegoaQz2mYMkg3X8q1u-CQAAAgE"]
[Wed Apr 22 09:46:17.729936 2026] [:error] [pid 23041:tid 23049] [client 91.230.225.178:30915] [client 91.230.225.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aegoaUTXx_lUa7xwAb4z5wAAAQU"]
[Wed Apr 22 09:46:18.289801 2026] [:error] [pid 31756:tid 31809] [client 185.192.71.230:54365] [client 185.192.71.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aegoat_WbkXbHaEfhd3_iAAAAlE"]
[Wed Apr 22 09:46:19.259401 2026] [:error] [pid 31756:tid 31811] [client 185.92.25.97:40037] [client 185.92.25.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aegoa9_WbkXbHaEfhd3_kAAAAlM"]
[Wed Apr 22 10:14:54.678934 2026] [:error] [pid 31755:tid 31770] [client 43.130.9.111:37716] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aegvHgz2mYMkg3X8q1vQDAAAAgc"]
[Wed Apr 22 11:41:43.540869 2026] [:error] [pid 32053:tid 32075] [client 43.140.247.223:53180] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aehDdwzPjXx_ocfbYhtcXQAAA1Q"]
[Wed Apr 22 15:57:46.955333 2026] [:error] [pid 6344:tid 6373] [client 43.166.132.142:57448] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeh_ekDOTF-pkQnDeUmSagAAABg"]
[Wed Apr 22 16:21:54.216950 2026] [:error] [pid 6344:tid 6350] [client 92.97.53.88:52356] [client 92.97.53.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.97.53.88, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeiFIkDOTF-pkQnDeUmZbwAAAAE"]
[Wed Apr 22 18:07:12.356352 2026] [:error] [pid 6384:tid 6400] [client 101.42.46.71:51162] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeid0D58M3t15ICeWHXjAAAAAM0"]
[Wed Apr 22 21:35:25.072893 2026] [:error] [pid 6344:tid 6364] [client 150.109.46.88:46928] [client 150.109.46.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aejOnUDOTF-pkQnDeUn92QAAAA8"]
[Thu Apr 23 00:18:44.591674 2026] [:error] [pid 6344:tid 6349] [client 170.106.180.246:53162] [client 170.106.180.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aej05EDOTF-pkQnDeUknowAAAAA"]
[Thu Apr 23 00:57:40.337074 2026] [:error] [pid 6344:tid 6352] [client 182.44.67.97:57714] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aej-BEDOTF-pkQnDeUkysgAAAAM"]
[Thu Apr 23 03:58:33.428026 2026] [:error] [pid 42973:tid 43055] [client 43.157.150.69:48662] [client 43.157.150.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aekoaW6I0QqmmmLTHE17UQAAAIw"]
[Thu Apr 23 07:03:56.054590 2026] [:error] [pid 42972:tid 43026] [client 101.42.46.71:55048] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aelT3MOAb-3sOknsk4f-1wAAAEo"]
[Thu Apr 23 07:13:40.769807 2026] [:error] [pid 25635:tid 25642] [client 43.135.140.225:51272] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aelWJMRxv6UsgRGKB3LFpwAAAQM"]
[Thu Apr 23 07:23:47.710944 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.136:20705] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelYg76vRb9j6psK2ZaLLwAAAgw"]
[Thu Apr 23 07:23:49.318258 2026] [:error] [pid 59700:tid 59718] [client 89.251.0.142:64643] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aelYhZXyGZJFeAIDWtlR7QAAAVA"]
[Thu Apr 23 07:23:50.495582 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.124:35077] [client 89.251.0.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/envato-css.php"] [unique_id "aelYhsOAb-3sOknsk4cX_gAAAEU"]
[Thu Apr 23 07:23:52.438543 2026] [:error] [pid 25635:tid 25640] [client 89.251.0.116:58057] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aelYiMRxv6UsgRGKB3LcNgAAAQE"]
[Thu Apr 23 07:23:54.339587 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.139:21549] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "aelYioV5EysYcTLjmwjsrgAAAcY"]
[Thu Apr 23 07:23:56.009101 2026] [:error] [pid 42973:tid 43058] [client 89.251.0.141:62429] [client 89.251.0.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aelYjG6I0QqmmmLTHE3VewAAAI8"]
[Thu Apr 23 07:23:57.595390 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.132:55757] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aelYjb6vRb9j6psK2ZaMYAAAAgk"]
[Thu Apr 23 07:23:58.505675 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.129:52919] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aelYjr6vRb9j6psK2ZaMfgAAAhY"]
[Thu Apr 23 07:23:59.102867 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.133:22521] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aelYj76vRb9j6psK2ZaMhAAAAgk"]
[Thu Apr 23 07:23:59.920820 2026] [:error] [pid 42972:tid 43028] [client 89.251.0.126:52317] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aelYj8OAb-3sOknsk4cYRwAAAEw"]
[Thu Apr 23 07:24:00.656593 2026] [:error] [pid 59700:tid 59714] [client 89.251.0.117:30073] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aelYkJXyGZJFeAIDWtlSRwAAAUw"]
[Thu Apr 23 07:24:01.410860 2026] [:error] [pid 64998:tid 65006] [client 89.251.0.134:60833] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aelYkYV5EysYcTLjmwjtDAAAAcQ"]
[Thu Apr 23 07:24:02.326769 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.137:36563] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aelYkjEP2_5RswrH8bGgzgAAAAU"]
[Thu Apr 23 07:24:03.587791 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.137:26489] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "aelYkzC5hrvNXosL83LCwwAAANU"]
[Thu Apr 23 07:24:04.793573 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.131:43973] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aelYlL6vRb9j6psK2ZaNCAAAAgU"]
[Thu Apr 23 07:24:05.393018 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.145:63777] [client 89.251.0.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/js/index.php"] [unique_id "aelYlYAV4GfOOdX8QzoLHAAAAZY"]
[Thu Apr 23 07:24:06.321119 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.114:20811] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aelYlsOAb-3sOknsk4cYiwAAAEU"]
[Thu Apr 23 07:24:07.349793 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.141:55101] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aelYl8Rxv6UsgRGKB3LcrgAAARQ"]
[Thu Apr 23 07:24:10.088011 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.114:22763] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aelYmoAV4GfOOdX8QzoLRgAAAZE"]
[Thu Apr 23 07:24:11.022958 2026] [:error] [pid 42972:tid 43028] [client 89.251.0.126:65349] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aelYm8OAb-3sOknsk4cYwQAAAEw"]
[Thu Apr 23 07:24:20.633648 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.145:47597] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "aelYpMOAb-3sOknsk4cZAAAAAE0"]
[Thu Apr 23 07:24:21.567504 2026] [:error] [pid 59700:tid 59711] [client 89.251.0.126:55299] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aelYpZXyGZJFeAIDWtlS6AAAAUk"]
[Thu Apr 23 07:24:23.546640 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.115:28169] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aelYp4AV4GfOOdX8QzoMDAAAAYk"]
[Thu Apr 23 07:24:24.180655 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.120:32353] [client 89.251.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aelYqDEP2_5RswrH8bGhdwAAAAg"]
[Thu Apr 23 07:24:25.190714 2026] [:error] [pid 25635:tid 25640] [client 89.251.0.121:55545] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aelYqcRxv6UsgRGKB3LdVwAAAQE"]
[Thu Apr 23 07:24:26.169973 2026] [:error] [pid 59700:tid 59726] [client 89.251.0.123:50639] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aelYqpXyGZJFeAIDWtlTCwAAAVg"]
[Thu Apr 23 07:24:26.820693 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.144:62919] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aelYqoV5EysYcTLjmwjvBAAAAdY"]
[Thu Apr 23 07:24:27.480905 2026] [:error] [pid 64998:tid 65020] [client 89.251.0.123:59749] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aelYq4V5EysYcTLjmwjvEgAAAdI"]
[Thu Apr 23 07:24:29.105480 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.126:53663] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aelYrb6vRb9j6psK2ZaPLgAAAhc"]
[Thu Apr 23 07:24:29.731119 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.131:57719] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class.api.php"] [unique_id "aelYrTC5hrvNXosL83LDhgAAAMM"]
[Thu Apr 23 07:24:30.379967 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.132:34617] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aelYrjC5hrvNXosL83LDjQAAAMI"]
[Thu Apr 23 07:24:33.895192 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.134:29683] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/admin.php"] [unique_id "aelYsTC5hrvNXosL83LDzwAAANU"]
[Thu Apr 23 07:24:42.935129 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.142:20169] [client 89.251.0.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.142, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aelYusRxv6UsgRGKB3Ld9wAAAQY"]
[Thu Apr 23 07:24:47.215384 2026] [:error] [pid 25635:tid 25653] [client 89.251.0.142:20169] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aelYv8Rxv6UsgRGKB3LeIgAAAQ4"]
[Thu Apr 23 07:24:48.544632 2026] [:error] [pid 42971:tid 42989] [client 89.251.0.144:29985] [client 89.251.0.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.144, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aelYwDEP2_5RswrH8bGigAAAAAM"]
[Thu Apr 23 07:24:49.165249 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.144:29985] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/item.php"] [unique_id "aelYwTEP2_5RswrH8bGijAAAAAU"]
[Thu Apr 23 07:24:52.442130 2026] [:error] [pid 42972:tid 43037] [client 89.251.0.146:54673] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aelYxMOAb-3sOknsk4cadQAAAFU"]
[Thu Apr 23 07:24:56.574794 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.150:29731] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aelYyMOAb-3sOknsk4caxgAAAE4"]
[Thu Apr 23 07:24:58.296612 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.135:20423] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aelYyjC5hrvNXosL83LEyQAAANY"]
[Thu Apr 23 07:24:59.958250 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.148:44077] [client 89.251.0.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.148, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aelYy8Rxv6UsgRGKB3LegQAAARQ"]
[Thu Apr 23 07:25:00.315069 2026] [:error] [pid 25635:tid 25653] [client 89.251.0.148:44077] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aelYzMRxv6UsgRGKB3LeiQAAAQ4"]
[Thu Apr 23 07:25:17.938366 2026] [:error] [pid 42972:tid 43037] [client 89.251.0.138:36007] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aelY3cOAb-3sOknsk4ccBwAAAFU"]
[Thu Apr 23 07:25:20.662538 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.115:27559] [client 89.251.0.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.115, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aelY4IV5EysYcTLjmwjxFwAAAcY"]
[Thu Apr 23 07:25:22.011711 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.115:27559] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aelY4oV5EysYcTLjmwjxMwAAAcg"]
[Thu Apr 23 07:25:22.928444 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.114:63061] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/infi.php"] [unique_id "aelY4oV5EysYcTLjmwjxPwAAAcE"]
[Thu Apr 23 07:25:24.223719 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.131:28503] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aelY5DC5hrvNXosL83LGAQAAANg"]
[Thu Apr 23 07:25:26.049355 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.147:60859] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aelY5jEP2_5RswrH8bGkPgAAABY"]
[Thu Apr 23 07:25:26.658449 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.124:23787] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aelY5oV5EysYcTLjmwjxigAAAdE"]
[Thu Apr 23 07:25:29.216868 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.116:61139] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aelY6cOAb-3sOknsk4ccVQAAAFM"]
[Thu Apr 23 07:25:30.197572 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.139:53199] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aelY6r6vRb9j6psK2ZaT7wAAAgA"]
[Thu Apr 23 07:25:32.259836 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.129:20399] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit.php"] [unique_id "aelY7IAV4GfOOdX8QzoPdgAAAZY"]
[Thu Apr 23 07:25:33.824848 2026] [:error] [pid 25635:tid 25663] [client 89.251.0.132:23993] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aelY7cRxv6UsgRGKB3LfigAAARg"]
[Thu Apr 23 07:25:35.162110 2026] [:error] [pid 42971:tid 42987] [client 89.251.0.138:56025] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/click.php"] [unique_id "aelY7zEP2_5RswrH8bGkpgAAAAE"]
[Thu Apr 23 07:25:36.137566 2026] [:error] [pid 25635:tid 25655] [client 89.251.0.124:26833] [client 89.251.0.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "aelY8MRxv6UsgRGKB3LflgAAARA"]
[Thu Apr 23 07:25:37.428309 2026] [:error] [pid 42972:tid 43032] [client 89.251.0.141:21551] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aelY8cOAb-3sOknsk4ccpQAAAFA"]
[Thu Apr 23 07:25:41.282845 2026] [:error] [pid 43083:tid 43103] [client 89.251.0.127:45877] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aelY9TC5hrvNXosL83LGtQAAANI"]
[Thu Apr 23 07:25:41.990450 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.129:55229] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aelY9TEP2_5RswrH8bGlEwAAABY"]
[Thu Apr 23 07:25:44.275823 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.119:53469] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aelY-MOAb-3sOknsk4cc5AAAAEI"]
[Thu Apr 23 07:25:44.887559 2026] [:error] [pid 59700:tid 59719] [client 89.251.0.147:54425] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aelY-JXyGZJFeAIDWtlVsAAAAVE"]
[Thu Apr 23 07:25:46.532648 2026] [:error] [pid 59700:tid 59721] [client 89.251.0.135:33065] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aelY-pXyGZJFeAIDWtlVwgAAAVM"]
[Thu Apr 23 07:25:47.180931 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.113:54329] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aelY-76vRb9j6psK2ZaUpgAAAgU"]
[Thu Apr 23 07:25:48.986391 2026] [:error] [pid 64998:tid 65025] [client 89.251.0.113:28839] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "aelY_IV5EysYcTLjmwjy6wAAAdc"]
[Thu Apr 23 07:25:50.296569 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.124:22279] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aelY_sRxv6UsgRGKB3Lf4QAAAQU"]
[Thu Apr 23 07:25:50.992087 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.141:45573] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aelY_r6vRb9j6psK2ZaU1wAAAgs"]
[Thu Apr 23 07:25:51.640864 2026] [:error] [pid 64967:tid 64979] [client 89.251.0.117:40009] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aelY_4AV4GfOOdX8QzoQAQAAAYo"]
[Thu Apr 23 07:25:52.581367 2026] [:error] [pid 64998:tid 65022] [client 89.251.0.147:46453] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aelZAIV5EysYcTLjmwjzDwAAAdQ"]
[Thu Apr 23 07:25:54.274301 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.127:33007] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aelZAoV5EysYcTLjmwjzMAAAAcs"]
[Thu Apr 23 07:25:56.251271 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.139:50705] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aelZBMOAb-3sOknsk4cdcQAAAFg"]
[Thu Apr 23 07:25:59.148083 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.148:53859] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aelZB4AV4GfOOdX8QzoQWQAAAZY"]
[Thu Apr 23 07:26:00.823766 2026] [:error] [pid 64998:tid 65018] [client 89.251.0.119:36373] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aelZCIV5EysYcTLjmwjzbgAAAdA"]
[Thu Apr 23 07:26:01.545126 2026] [:error] [pid 64967:tid 64979] [client 89.251.0.148:33135] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aelZCYAV4GfOOdX8QzoQZgAAAYo"]
[Thu Apr 23 07:26:03.596015 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.121:23253] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aelZCzC5hrvNXosL83LHdQAAAM4"]
[Thu Apr 23 07:26:05.476325 2026] [proxy_fcgi:error] [pid 25635:tid 25645] [client 89.251.0.143:65305] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:05.829413 2026] [proxy_fcgi:error] [pid 25635:tid 25641] [client 89.251.0.143:65305] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:06.141315 2026] [proxy_fcgi:error] [pid 25635:tid 25657] [client 89.251.0.143:65305] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:08.111124 2026] [:error] [pid 25635:tid 25649] [client 89.251.0.143:65305] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aelZEMRxv6UsgRGKB3LgTAAAAQo"]
[Thu Apr 23 07:26:08.703402 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.134:61371] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aelZEDC5hrvNXosL83LHoAAAAM4"]
[Thu Apr 23 07:26:09.322848 2026] [:error] [pid 25635:tid 25639] [client 89.251.0.143:26845] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aelZEcRxv6UsgRGKB3LgVwAAAQA"]
[Thu Apr 23 07:26:09.887290 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.148:58331] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aelZEb6vRb9j6psK2ZaVtwAAAgw"]
[Thu Apr 23 07:26:10.572083 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.128:25827] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aelZEjC5hrvNXosL83LHrgAAANE"]
[Thu Apr 23 07:26:11.199832 2026] [:error] [pid 42973:tid 43066] [client 89.251.0.133:62231] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aelZE26I0QqmmmLTHE3ZHgAAAJc"]
[Thu Apr 23 07:26:12.129572 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.114:51167] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aelZFDC5hrvNXosL83LH0gAAANQ"]
[Thu Apr 23 07:26:12.768255 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.146:52619] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aelZFL6vRb9j6psK2ZaVzwAAAgk"]
[Thu Apr 23 07:26:13.403692 2026] [:error] [pid 59700:tid 59719] [client 89.251.0.115:30023] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aelZFZXyGZJFeAIDWtlW3gAAAVE"]
[Thu Apr 23 07:26:14.049766 2026] [:error] [pid 59700:tid 59706] [client 89.251.0.123:60565] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aelZFpXyGZJFeAIDWtlW6QAAAUQ"]
[Thu Apr 23 07:26:15.224834 2026] [:error] [pid 42971:tid 43001] [client 89.251.0.143:56513] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aelZFzEP2_5RswrH8bGmoAAAAA8"]
[Thu Apr 23 07:26:16.256115 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.151:34591] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aelZGDEP2_5RswrH8bGmtQAAABc"]
[Thu Apr 23 07:26:17.576487 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.115:48545] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aelZGb6vRb9j6psK2ZaWBQAAAgI"]
[Thu Apr 23 07:26:18.722860 2026] [:error] [pid 42973:tid 43053] [client 89.251.0.151:22653] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/about.php"] [unique_id "aelZGm6I0QqmmmLTHE3ZTgAAAIo"]
[Thu Apr 23 07:26:20.838494 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.139:59479] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aelZHL6vRb9j6psK2ZaWPAAAAg8"]
[Thu Apr 23 07:26:22.874927 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.144:21709] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aelZHsOAb-3sOknsk4ceOgAAAEQ"]
[Thu Apr 23 07:26:26.869387 2026] [:error] [pid 64967:tid 64985] [client 89.251.0.138:47119] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aelZIoAV4GfOOdX8QzoRIQAAAZA"]
[Thu Apr 23 07:26:32.872526 2026] [:error] [pid 42971:tid 42986] [client 89.251.0.123:52997] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aelZKDEP2_5RswrH8bGn9gAAAAA"]
[Thu Apr 23 07:26:33.478629 2026] [:error] [pid 42973:tid 43052] [client 89.251.0.139:31057] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aelZKW6I0QqmmmLTHE3ZxwAAAIk"]
[Thu Apr 23 07:26:34.391155 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.150:48835] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aelZKpXyGZJFeAIDWtlYEgAAAUU"]
[Thu Apr 23 07:26:35.704570 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.125:28405] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aelZKzC5hrvNXosL83LIbAAAAMo"]
[Thu Apr 23 07:26:36.278924 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.126:46891] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aelZLDC5hrvNXosL83LIdwAAAMY"]
[Thu Apr 23 07:26:38.182692 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.129:59147] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aelZLsOAb-3sOknsk4cewQAAAFM"]
[Thu Apr 23 07:26:38.750726 2026] [:error] [pid 25635:tid 25649] [client 89.251.0.138:33529] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aelZLsRxv6UsgRGKB3Lg1gAAAQo"]
[Thu Apr 23 07:26:41.045661 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.148:61009] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aelZMb6vRb9j6psK2ZaWyAAAAhg"]
[Thu Apr 23 07:26:42.050319 2026] [proxy_fcgi:error] [pid 42971:tid 42995] [client 89.251.0.114:27785] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:42.631739 2026] [:error] [pid 42971:tid 42989] [client 89.251.0.114:27785] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/function.php"] [unique_id "aelZMjEP2_5RswrH8bGobQAAAAM"]
[Thu Apr 23 07:26:43.250073 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.147:49883] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugins.php"] [unique_id "aelZM76vRb9j6psK2ZaW7gAAAg0"]
[Thu Apr 23 07:26:44.460122 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.128:54493] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aelZNL6vRb9j6psK2ZaXCgAAAg0"]
[Thu Apr 23 07:26:45.055958 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.127:25093] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aelZNTC5hrvNXosL83LIuQAAAMM"]
[Thu Apr 23 07:26:48.185434 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.116:53147] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aelZOIV5EysYcTLjmwj0-gAAAcY"]
[Thu Apr 23 07:26:48.784411 2026] [:error] [pid 42971:tid 43010] [client 89.251.0.136:46773] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aelZODEP2_5RswrH8bGoowAAABg"]
[Thu Apr 23 07:26:50.652871 2026] [:error] [pid 42971:tid 42999] [client 89.251.0.148:31287] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "aelZOjEP2_5RswrH8bGo1wAAAA0"]
[Thu Apr 23 07:26:51.207473 2026] [:error] [pid 42973:tid 43047] [client 89.251.0.143:38571] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aelZO26I0QqmmmLTHE3aIgAAAIQ"]
[Thu Apr 23 07:26:51.791625 2026] [:error] [pid 64967:tid 64974] [client 89.251.0.132:43741] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aelZO4AV4GfOOdX8QzoSAgAAAYU"]
[Thu Apr 23 07:26:54.703314 2026] [:error] [pid 42973:tid 43043] [client 89.251.0.131:36411] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aelZPm6I0QqmmmLTHE3aSQAAAIA"]
[Thu Apr 23 07:26:55.726446 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.137:26323] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aelZPzC5hrvNXosL83LJGAAAAMY"]
[Thu Apr 23 07:26:58.627542 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.126:42551] [client 89.251.0.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.126, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/js/wp-login.php"] [unique_id "aelZQr6vRb9j6psK2ZaXjgAAAgM"]
[Thu Apr 23 07:27:00.570401 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.126:42551] [client 89.251.0.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.126, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aelZRL6vRb9j6psK2ZaXoAAAAhI"]
[Thu Apr 23 07:27:04.554306 2026] [proxy_fcgi:error] [pid 65000:tid 65042] [client 89.251.0.126:42551] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:09.285205 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.126:42551] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aelZTb6vRb9j6psK2ZaYEQAAAg8"]
[Thu Apr 23 07:27:10.926169 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.142:49817] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aelZToV5EysYcTLjmwj2EwAAAcY"]
[Thu Apr 23 07:27:12.314936 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.150:53819] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aelZUG6I0QqmmmLTHE3apAAAAJY"]
[Thu Apr 23 07:27:15.826109 2026] [:error] [pid 42971:tid 42989] [client 89.251.0.113:46427] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aelZUzEP2_5RswrH8bGp5gAAAAM"]
[Thu Apr 23 07:27:17.157331 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.114:35081] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aelZVb6vRb9j6psK2ZaYQAAAAgs"]
[Thu Apr 23 07:27:18.091728 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.148:24115] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aelZVr6vRb9j6psK2ZaYSQAAAhc"]
[Thu Apr 23 07:27:20.104292 2026] [proxy_fcgi:error] [pid 59700:tid 59711] [client 89.251.0.133:47069] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:20.401928 2026] [proxy_fcgi:error] [pid 59700:tid 59724] [client 89.251.0.133:47069] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:20.757687 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.133:47069] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aelZWJXyGZJFeAIDWtlZRQAAAUU"]
[Thu Apr 23 07:27:21.390883 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.129:47245] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aelZWb6vRb9j6psK2ZaYYgAAAhY"]
[Thu Apr 23 07:27:23.263497 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.140:26229] [client 89.251.0.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/fix/as.php"] [unique_id "aelZW76vRb9j6psK2ZaYnAAAAgY"]
[Thu Apr 23 07:27:24.886261 2026] [:error] [pid 59700:tid 59714] [client 89.251.0.125:38681] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aelZXJXyGZJFeAIDWtlZbgAAAUw"]
[Thu Apr 23 07:27:25.797878 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.136:38159] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "aelZXYV5EysYcTLjmwj2igAAAc0"]
[Thu Apr 23 07:27:27.360324 2026] [:error] [pid 42973:tid 43046] [client 89.251.0.125:56475] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aelZX26I0QqmmmLTHE3aygAAAIM"]
[Thu Apr 23 07:27:30.757940 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.114:57439] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aelZYr6vRb9j6psK2ZaZDgAAAgA"]
[Thu Apr 23 07:27:31.385041 2026] [proxy_fcgi:error] [pid 64967:tid 64993] [client 89.251.0.141:45989] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:32.421665 2026] [:error] [pid 64967:tid 64977] [client 89.251.0.141:45989] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aelZZIAV4GfOOdX8QzoTewAAAYg"]
[Thu Apr 23 07:27:34.755314 2026] [proxy_fcgi:error] [pid 64967:tid 64977] [client 89.251.0.116:42411] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:35.412472 2026] [:error] [pid 64967:tid 64985] [client 89.251.0.116:42411] [client 89.251.0.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.116, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aelZZ4AV4GfOOdX8QzoTkgAAAZA"]
[Thu Apr 23 07:27:37.231551 2026] [:error] [pid 64967:tid 64993] [client 89.251.0.116:42411] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aelZaYAV4GfOOdX8QzoToAAAAZg"]
[Thu Apr 23 07:27:38.372520 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.128:45755] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aelZaoV5EysYcTLjmwj3BgAAAcM"]
[Thu Apr 23 07:27:40.588171 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.138:65125] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aelZbL6vRb9j6psK2ZaZdAAAAgs"]
[Thu Apr 23 07:27:42.400380 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.141:56573] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aelZbjC5hrvNXosL83LLdQAAANY"]
[Thu Apr 23 07:27:42.964070 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.135:32755] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aelZbjEP2_5RswrH8bGrAAAAAAs"]
[Thu Apr 23 07:27:44.651374 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.117:42769] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aelZcDC5hrvNXosL83LLkgAAAM0"]
[Thu Apr 23 07:27:45.969305 2026] [proxy_fcgi:error] [pid 42972:tid 43029] [client 89.251.0.120:30217] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:46.301254 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.120:30217] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aelZcsOAb-3sOknsk4chdwAAAEU"]
[Thu Apr 23 07:27:47.251842 2026] [:error] [pid 25635:tid 25651] [client 89.251.0.121:21059] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/db.php"] [unique_id "aelZc8Rxv6UsgRGKB3LiUgAAAQw"]
[Thu Apr 23 07:27:47.911162 2026] [:error] [pid 42973:tid 43061] [client 89.251.0.116:24333] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aelZc26I0QqmmmLTHE3bPAAAAJI"]
[Thu Apr 23 07:27:49.113591 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.123:61487] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aelZdTC5hrvNXosL83LLqAAAAM4"]
[Thu Apr 23 07:27:49.751525 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.114:59541] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aelZdTC5hrvNXosL83LLtQAAAMc"]
[Thu Apr 23 07:27:50.440392 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.138:25087] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aelZdoV5EysYcTLjmwj3XQAAAdE"]
[Thu Apr 23 07:27:51.209891 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.116:46611] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aelZd4V5EysYcTLjmwj3awAAAc8"]
[Thu Apr 23 07:27:52.561931 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.148:44613] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aelZeMOAb-3sOknsk4choAAAAEQ"]
[Thu Apr 23 07:27:53.286874 2026] [:error] [pid 42973:tid 43043] [client 89.251.0.147:46411] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aelZeW6I0QqmmmLTHE3bUAAAAIA"]
[Thu Apr 23 07:27:53.909463 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.124:61417] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aelZeYV5EysYcTLjmwj3fwAAAcY"]
[Thu Apr 23 07:27:54.718806 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.119:39505] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aelZejC5hrvNXosL83LMEAAAAMM"]
[Thu Apr 23 07:27:55.473606 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.123:50805] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aelZe76vRb9j6psK2ZaaTAAAAgY"]
[Thu Apr 23 07:27:56.071621 2026] [proxy_fcgi:error] [pid 65000:tid 65057] [client 89.251.0.143:39383] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:57.184892 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.143:39383] [client 89.251.0.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.143, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aelZfb6vRb9j6psK2ZaaewAAAhA"]
[Thu Apr 23 07:27:59.240402 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.143:39383] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aelZf76vRb9j6psK2ZaaoQAAAgA"]
[Thu Apr 23 07:28:05.412724 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.128:50221] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aelZhb6vRb9j6psK2ZabDwAAAhI"]
[Thu Apr 23 07:28:06.074954 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.139:24535] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aelZhr6vRb9j6psK2ZabHAAAAgQ"]
[Thu Apr 23 07:28:06.713599 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.135:52573] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aelZhsRxv6UsgRGKB3LizwAAAQU"]
[Thu Apr 23 07:28:12.930313 2026] [:error] [pid 43083:tid 43089] [client 89.251.0.113:26853] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aelZjDC5hrvNXosL83LNLQAAAMQ"]
[Thu Apr 23 07:28:13.544689 2026] [:error] [pid 42971:tid 43005] [client 89.251.0.123:20661] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aelZjTEP2_5RswrH8bGrqgAAABM"]
[Thu Apr 23 07:28:14.139530 2026] [:error] [pid 59700:tid 59708] [client 89.251.0.127:24645] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aelZjpXyGZJFeAIDWtlbDAAAAUY"]
[Thu Apr 23 07:28:16.896129 2026] [:error] [pid 42972:tid 43025] [client 89.251.0.138:57841] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aelZkMOAb-3sOknsk4ciDgAAAEk"]
[Thu Apr 23 07:28:17.753553 2026] [:error] [pid 64967:tid 64990] [client 89.251.0.144:45371] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aelZkYAV4GfOOdX8QzoUzAAAAZU"]
[Thu Apr 23 07:28:19.233545 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.148:29671] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aelZk8OAb-3sOknsk4ciLwAAAE0"]
[Thu Apr 23 07:28:23.523792 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.123:43891] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aelZl26I0QqmmmLTHE3cGwAAAIw"]
[Thu Apr 23 07:28:24.405662 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.132:39573] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "aelZmL6vRb9j6psK2ZacEwAAAg0"]
[Thu Apr 23 07:28:30.152248 2026] [:error] [pid 42972:tid 43031] [client 89.251.0.144:34499] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aelZnsOAb-3sOknsk4cidgAAAE8"]
[Thu Apr 23 07:28:31.755320 2026] [:error] [pid 42971:tid 42996] [client 89.251.0.120:53513] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aelZnzEP2_5RswrH8bGsRwAAAAo"]
[Thu Apr 23 07:28:34.225016 2026] [:error] [pid 42972:tid 43017] [client 89.251.0.123:29565] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aelZosOAb-3sOknsk4cihQAAAEE"]
[Thu Apr 23 07:28:36.271788 2026] [:error] [pid 42973:tid 43060] [client 89.251.0.146:36699] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aelZpG6I0QqmmmLTHE3cWQAAAJE"]
[Thu Apr 23 07:28:37.663181 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.129:26861] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aelZpcOAb-3sOknsk4cingAAAEg"]
[Thu Apr 23 07:28:38.279494 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.113:22935] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aelZpr6vRb9j6psK2ZacmgAAAgc"]
[Thu Apr 23 07:28:41.139635 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.116:35825] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aelZqb6vRb9j6psK2Zac3wAAAgc"]
[Thu Apr 23 07:28:44.079681 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.136:52049] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aelZrIV5EysYcTLjmwj5mgAAAcM"]
[Thu Apr 23 07:28:47.049718 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.135:65443] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aelZrzEP2_5RswrH8bGstwAAABc"]
[Thu Apr 23 07:28:47.728205 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.119:53687] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aelZr8Rxv6UsgRGKB3LjgQAAAQU"]
[Thu Apr 23 07:28:48.814991 2026] [:error] [pid 42972:tid 43034] [client 89.251.0.144:64009] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aelZsMOAb-3sOknsk4ci1QAAAFI"]
[Thu Apr 23 07:28:50.076795 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.117:34047] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/install.php"] [unique_id "aelZssOAb-3sOknsk4ci_AAAAEg"]
[Thu Apr 23 07:28:50.988966 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.126:59155] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aelZsjC5hrvNXosL83LO7wAAANQ"]
[Thu Apr 23 07:28:53.984202 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.136:51769] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/category-double.php"] [unique_id "aelZtcOAb-3sOknsk4cjIwAAAFM"]
[Thu Apr 23 07:28:55.250560 2026] [:error] [pid 42972:tid 43026] [client 89.251.0.128:34367] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aelZt8OAb-3sOknsk4cjKQAAAEo"]
[Thu Apr 23 07:28:56.069951 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.147:39739] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aelZuDC5hrvNXosL83LPMQAAAMo"]
[Thu Apr 23 07:28:57.749249 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.143:61437] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aelZucOAb-3sOknsk4cjNgAAAE0"]
[Thu Apr 23 07:28:59.186408 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.135:39327] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aelZu4V5EysYcTLjmwj6NAAAAc8"]
[Thu Apr 23 07:29:02.113132 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.119:59205] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aelZvoV5EysYcTLjmwj6YgAAAcg"]
[Thu Apr 23 07:29:03.396972 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.117:35723] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aelZv76vRb9j6psK2ZadzQAAAgo"]
[Thu Apr 23 07:29:04.940475 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.140:51289] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aelZwDC5hrvNXosL83LPnAAAAMc"]
[Thu Apr 23 07:29:05.877514 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.128:24779] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/as.php"] [unique_id "aelZwb6vRb9j6psK2Zad4wAAAhQ"]
[Thu Apr 23 07:29:07.119330 2026] [:error] [pid 42971:tid 42993] [client 89.251.0.115:55369] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aelZwzEP2_5RswrH8bGtcAAAAAc"]
[Thu Apr 23 07:29:07.823603 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.116:46509] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/install.php"] [unique_id "aelZw8OAb-3sOknsk4cjVgAAAEA"]
[Thu Apr 23 07:29:08.449469 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.124:57163] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aelZxDC5hrvNXosL83LPugAAANA"]
[Thu Apr 23 07:29:11.150056 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.134:26393] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aelZx8OAb-3sOknsk4cjkAAAAFg"]
[Thu Apr 23 07:29:12.763130 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.136:43649] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rk2.php"] [unique_id "aelZyL6vRb9j6psK2ZaeCgAAAgU"]
[Thu Apr 23 07:29:14.052558 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.129:57783] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aelZyjC5hrvNXosL83LP6wAAANc"]
[Thu Apr 23 07:29:15.443416 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.114:36315] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aelZy76vRb9j6psK2ZaeMAAAAhg"]
[Thu Apr 23 07:29:17.856737 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.115:47673] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aelZzcOAb-3sOknsk4cj4gAAAEU"]
[Thu Apr 23 07:29:18.925165 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.132:25579] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aelZzsRxv6UsgRGKB3LkLwAAARE"]
[Thu Apr 23 07:29:19.846767 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.116:52871] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aelZz8Rxv6UsgRGKB3LkOQAAAQY"]
[Thu Apr 23 07:29:21.107250 2026] [:error] [pid 43083:tid 43085] [client 89.251.0.144:28559] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aelZ0TC5hrvNXosL83LQMgAAAMA"]
[Thu Apr 23 07:29:24.294123 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.142:51741] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aelZ1DEP2_5RswrH8bGudwAAAAs"]
[Thu Apr 23 07:29:26.227416 2026] [:error] [pid 64998:tid 65002] [client 89.251.0.117:20981] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aelZ1oV5EysYcTLjmwj7NQAAAcA"]
[Thu Apr 23 07:29:27.804916 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.115:36189] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aelZ1zC5hrvNXosL83LQhwAAANU"]
[Thu Apr 23 07:29:28.530140 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.121:22949] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aelZ2G6I0QqmmmLTHE3ddQAAAJY"]
[Thu Apr 23 07:29:29.860056 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.128:65385] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aelZ2ZXyGZJFeAIDWtldmgAAAVQ"]
[Thu Apr 23 07:29:30.552876 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.148:57973] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aelZ2sRxv6UsgRGKB3LkbAAAARE"]
[Thu Apr 23 07:29:31.376611 2026] [:error] [pid 64998:tid 65023] [client 89.251.0.127:21901] [client 89.251.0.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.127, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aelZ24V5EysYcTLjmwj7jAAAAdU"]
[Thu Apr 23 07:29:31.401419 2026] [proxy_fcgi:error] [pid 64998:tid 65023] [client 89.251.0.127:21901] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:31.840655 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.127:21901] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aelZ24V5EysYcTLjmwj7lgAAAdM"]
[Thu Apr 23 07:29:33.483303 2026] [:error] [pid 43083:tid 43100] [client 89.251.0.120:25809] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aelZ3TC5hrvNXosL83LQ0wAAAM8"]
[Thu Apr 23 07:29:34.174191 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.117:49469] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/network.php"] [unique_id "aelZ3oV5EysYcTLjmwj70QAAAc4"]
[Thu Apr 23 07:29:37.083443 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.115:24609] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aelZ4TC5hrvNXosL83LRHwAAAMY"]
[Thu Apr 23 07:29:37.664111 2026] [:error] [pid 43083:tid 43093] [client 89.251.0.144:42041] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aelZ4TC5hrvNXosL83LROQAAAMg"]
[Thu Apr 23 07:29:39.016139 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.126:48669] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aelZ4zC5hrvNXosL83LRbwAAAMw"]
[Thu Apr 23 07:29:39.617927 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.128:53627] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aelZ44V5EysYcTLjmwj77wAAAcY"]
[Thu Apr 23 07:29:40.329722 2026] [proxy_fcgi:error] [pid 42971:tid 43009] [client 89.251.0.134:33081] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:40.655095 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.134:33081] [client 89.251.0.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.134, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aelZ5DEP2_5RswrH8bGu9gAAABQ"]
[Thu Apr 23 07:29:41.284496 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.134:33081] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aelZ5TEP2_5RswrH8bGu-gAAAAU"]
[Thu Apr 23 07:29:43.200490 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.142:26841] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aelZ576vRb9j6psK2ZafIgAAAhY"]
[Thu Apr 23 07:29:44.621750 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.116:23201] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aelZ6L6vRb9j6psK2ZafOAAAAg0"]
[Thu Apr 23 07:29:45.232464 2026] [:error] [pid 59700:tid 59708] [client 89.251.0.133:53477] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aelZ6ZXyGZJFeAIDWtlebQAAAUY"]
[Thu Apr 23 07:29:46.962720 2026] [:error] [pid 42971:tid 42990] [client 89.251.0.121:53657] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aelZ6jEP2_5RswrH8bGvGQAAAAQ"]
[Thu Apr 23 07:29:48.436083 2026] [:error] [pid 25635:tid 25647] [client 89.251.0.133:27495] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aelZ7MRxv6UsgRGKB3LkxQAAAQg"]
[Thu Apr 23 07:29:50.345278 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.147:20643] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aelZ7r6vRb9j6psK2ZafkwAAAgc"]
[Thu Apr 23 07:29:50.917003 2026] [:error] [pid 64967:tid 64970] [client 89.251.0.129:42445] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bypass.php"] [unique_id "aelZ7oAV4GfOOdX8QzoW4AAAAYE"]
[Thu Apr 23 07:29:51.828002 2026] [:error] [pid 42972:tid 43027] [client 89.251.0.127:45545] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/count.php"] [unique_id "aelZ78OAb-3sOknsk4ckzwAAAEs"]
[Thu Apr 23 07:29:54.690372 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.144:21775] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aelZ8jC5hrvNXosL83LSVAAAANM"]
[Thu Apr 23 07:29:55.929966 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.146:27447] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com"] [uri "/images/stories/themes.php"] [unique_id "aelZ8zEP2_5RswrH8bGviQAAABQ"]
[Thu Apr 23 07:29:56.218159 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.146:27447] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aelZ9DEP2_5RswrH8bGvkQAAAAU"]
[Thu Apr 23 07:29:57.516024 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.114:61633] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aelZ9TC5hrvNXosL83LSeQAAAMM"]
[Thu Apr 23 07:29:58.181178 2026] [:error] [pid 42973:tid 43057] [client 89.251.0.123:27013] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aelZ9m6I0QqmmmLTHE3dxQAAAI4"]
[Thu Apr 23 07:30:03.049468 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.139:42829] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aelZ-8OAb-3sOknsk4clUgAAAEc"]
[Thu Apr 23 07:30:04.476568 2026] [:error] [pid 64967:tid 64980] [client 89.251.0.143:41687] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aelZ_IAV4GfOOdX8QzoXHgAAAYs"]
[Thu Apr 23 07:30:05.544588 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.144:35793] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aelZ_YV5EysYcTLjmwj88AAAAc4"]
[Thu Apr 23 07:30:07.920278 2026] [:error] [pid 42973:tid 43046] [client 89.251.0.140:39715] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aelZ_26I0QqmmmLTHE3d8AAAAIM"]
[Thu Apr 23 07:30:08.623252 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.123:46865] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/colour.php"] [unique_id "aelaADC5hrvNXosL83LSxgAAAMc"]
[Thu Apr 23 07:30:09.729487 2026] [:error] [pid 42973:tid 43052] [client 89.251.0.127:43895] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aelaAW6I0QqmmmLTHE3d_AAAAIk"]
[Thu Apr 23 07:30:10.631888 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.145:61061] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/include.php"] [unique_id "aelaAoV5EysYcTLjmwj9DQAAAcE"]
[Thu Apr 23 07:30:12.081256 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.125:41221] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aelaBDEP2_5RswrH8bGwFgAAAAg"]
[Thu Apr 23 07:30:13.404839 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.128:27785] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aelaBZXyGZJFeAIDWtlfPAAAAUU"]
[Thu Apr 23 07:30:14.016254 2026] [:error] [pid 42973:tid 43049] [client 89.251.0.129:62703] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aelaBm6I0QqmmmLTHE3eGwAAAIY"]
[Thu Apr 23 07:30:16.681473 2026] [:error] [pid 59700:tid 59709] [client 89.251.0.125:28861] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aelaCJXyGZJFeAIDWtlfcAAAAUc"]
[Thu Apr 23 07:30:18.071537 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.148:20263] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aelaCoV5EysYcTLjmwj9MwAAAdM"]
[Thu Apr 23 07:30:19.782381 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.126:55481] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aelaC76vRb9j6psK2Zag7QAAAhY"]
[Thu Apr 23 07:30:21.448810 2026] [:error] [pid 59700:tid 59718] [client 89.251.0.132:30939] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aelaDZXyGZJFeAIDWtlfiAAAAVA"]
[Thu Apr 23 07:30:22.079312 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.143:51659] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aelaDsRxv6UsgRGKB3LleAAAAQY"]
[Thu Apr 23 07:30:23.460980 2026] [:error] [pid 42972:tid 43022] [client 89.251.0.132:33835] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aelaD8OAb-3sOknsk4cmBQAAAEY"]
[Thu Apr 23 07:30:25.465530 2026] [:error] [pid 25635:tid 25653] [client 89.251.0.127:27807] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aelaEcRxv6UsgRGKB3LlfgAAAQ4"]
[Thu Apr 23 07:30:26.135388 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.148:29605] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aelaEjEP2_5RswrH8bGwUQAAAAU"]
[Thu Apr 23 07:30:27.744539 2026] [:error] [pid 42971:tid 43004] [client 89.251.0.123:27421] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aelaEzEP2_5RswrH8bGwbQAAABI"]
[Thu Apr 23 07:30:28.671157 2026] [:error] [pid 42971:tid 42986] [client 89.251.0.128:31099] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aelaFDEP2_5RswrH8bGwfgAAAAA"]
[Thu Apr 23 07:30:30.594628 2026] [:error] [pid 25635:tid 25660] [client 89.251.0.140:51287] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aelaFsRxv6UsgRGKB3LliQAAARU"]
[Thu Apr 23 07:30:32.219100 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.126:60567] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aelaGJXyGZJFeAIDWtlgIAAAAUM"]
[Thu Apr 23 07:30:32.874999 2026] [:error] [pid 43083:tid 43089] [client 89.251.0.140:50005] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aelaGDC5hrvNXosL83LTgQAAAMQ"]
[Thu Apr 23 07:30:33.523111 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.128:58525] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aelaGTEP2_5RswrH8bGwrgAAABY"]
[Thu Apr 23 07:30:34.947928 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.143:63049] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aelaGm6I0QqmmmLTHE3eRAAAAJA"]
[Thu Apr 23 07:30:36.419178 2026] [:error] [pid 25635:tid 25654] [client 89.251.0.145:39691] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aelaHMRxv6UsgRGKB3LlmwAAAQ8"]
[Thu Apr 23 07:30:37.491861 2026] [:error] [pid 64998:tid 65025] [client 89.251.0.115:25605] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aelaHYV5EysYcTLjmwj93QAAAdc"]
[Thu Apr 23 07:30:38.431162 2026] [:error] [pid 59700:tid 59706] [client 89.251.0.141:49885] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aelaHpXyGZJFeAIDWtlgZQAAAUQ"]
[Thu Apr 23 07:30:41.101475 2026] [:error] [pid 64967:tid 64976] [client 89.251.0.119:41293] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugin.php"] [unique_id "aelaIYAV4GfOOdX8QzoX1QAAAYc"]
[Thu Apr 23 07:30:41.832616 2026] [:error] [pid 42972:tid 43019] [client 89.251.0.123:54397] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aelaIcOAb-3sOknsk4cmOAAAAEM"]
[Thu Apr 23 07:30:43.305074 2026] [:error] [pid 42971:tid 43001] [client 89.251.0.116:20109] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aelaIzEP2_5RswrH8bGw_wAAAA8"]
[Thu Apr 23 07:30:45.465834 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.140:63243] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aelaJTEP2_5RswrH8bGxEgAAABE"]
[Thu Apr 23 07:30:46.905510 2026] [:error] [pid 42973:tid 43043] [client 89.251.0.137:23511] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aelaJm6I0QqmmmLTHE3edwAAAIA"]
[Thu Apr 23 07:30:49.106322 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.144:61027] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aelaKb6vRb9j6psK2ZaiUAAAAgM"]
[Thu Apr 23 07:30:50.115392 2026] [:error] [pid 42971:tid 43004] [client 89.251.0.150:34741] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aelaKjEP2_5RswrH8bGxNwAAABI"]
[Thu Apr 23 07:30:51.134351 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.151:25283] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aelaK4V5EysYcTLjmwj-VAAAAc4"]
[Thu Apr 23 07:30:53.552143 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.143:53893] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aelaLYV5EysYcTLjmwj-bgAAAcs"]
[Thu Apr 23 07:30:55.680005 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.133:47379] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aelaLzEP2_5RswrH8bGxWAAAABQ"]
[Thu Apr 23 07:30:56.515119 2026] [proxy_fcgi:error] [pid 59700:tid 59703] [client 89.251.0.126:28545] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:30:56.838532 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.126:28545] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aelaMJXyGZJFeAIDWtlg5wAAAUg"]
[Thu Apr 23 07:30:58.531945 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.128:61987] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aelaMoV5EysYcTLjmwj-qQAAAcM"]
[Thu Apr 23 07:31:00.621961 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.129:52541] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aelaNL6vRb9j6psK2ZajHgAAAg0"]
[Thu Apr 23 07:31:01.852780 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.124:33603] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aelaNb6vRb9j6psK2ZajNgAAAgI"]
[Thu Apr 23 07:31:05.161797 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.127:39293] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aelaOW6I0QqmmmLTHE3esQAAAIg"]
[Thu Apr 23 07:31:06.886653 2026] [:error] [pid 25635:tid 25660] [client 89.251.0.144:40843] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aelaOsRxv6UsgRGKB3LmAgAAARU"]
[Thu Apr 23 07:31:10.377378 2026] [:error] [pid 43083:tid 43090] [client 89.251.0.113:53881] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/log.php"] [unique_id "aelaPjC5hrvNXosL83LUuwAAAMU"]
[Thu Apr 23 07:31:11.266667 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.138:64925] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aelaP8Rxv6UsgRGKB3LmFQAAAQY"]
[Thu Apr 23 07:31:12.142154 2026] [:error] [pid 25635:tid 25651] [client 89.251.0.113:28109] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aelaQMRxv6UsgRGKB3LmHAAAAQw"]
[Thu Apr 23 07:31:12.877518 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.143:29645] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/aw.php"] [unique_id "aelaQL6vRb9j6psK2ZakIgAAAhQ"]
[Thu Apr 23 07:31:15.101162 2026] [:error] [pid 42971:tid 42992] [client 89.251.0.135:45817] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aelaQzEP2_5RswrH8bGxqQAAAAY"]
[Thu Apr 23 07:31:15.819171 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.141:41893] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/install.php"] [unique_id "aelaQ76vRb9j6psK2ZakUAAAAgo"]
[Thu Apr 23 07:31:17.537827 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.121:41497] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aelaRW6I0QqmmmLTHE3e7QAAAIw"]
[Thu Apr 23 07:31:18.274595 2026] [:error] [pid 42971:tid 42996] [client 89.251.0.125:60575] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aelaRjEP2_5RswrH8bGxsgAAAAo"]
[Thu Apr 23 07:31:20.833758 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.116:31711] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/template-less.php"] [unique_id "aelaSJXyGZJFeAIDWtlhjgAAAUI"]
[Thu Apr 23 07:31:21.680418 2026] [:error] [pid 59700:tid 59715] [client 89.251.0.133:63865] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aelaSZXyGZJFeAIDWtlhmAAAAU0"]
[Thu Apr 23 07:31:25.835905 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.127:34411] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aelaTTC5hrvNXosL83LVPgAAANc"]
[Thu Apr 23 07:31:26.451713 2026] [:error] [pid 64998:tid 65018] [client 89.251.0.151:23611] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aelaToV5EysYcTLjmwj_zAAAAdA"]
[Thu Apr 23 07:31:28.981450 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.134:63805] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/file.php"] [unique_id "aelaUL6vRb9j6psK2ZalRgAAAgc"]
[Thu Apr 23 07:31:32.169547 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.131:53895] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aelaVDC5hrvNXosL83LVdQAAAMM"]
[Thu Apr 23 07:31:33.430733 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.144:20443] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/load.php"] [unique_id "aelaVcOAb-3sOknsk4cnTwAAAEg"]
[Thu Apr 23 07:31:34.142583 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.137:64823] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aelaVjC5hrvNXosL83LVjAAAANU"]
[Thu Apr 23 07:31:34.856563 2026] [:error] [pid 42971:tid 43007] [client 89.251.0.126:52487] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aelaVjEP2_5RswrH8bGx9gAAABU"]
[Thu Apr 23 07:31:36.533663 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.128:30011] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aelaWIV5EysYcTLjmwgAWwAAAcg"]
[Thu Apr 23 07:31:37.683053 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.128:20225] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aelaWZXyGZJFeAIDWtlh-AAAAVY"]
[Thu Apr 23 07:31:38.976738 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.137:31957] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aelaWjEP2_5RswrH8bGyNwAAABc"]
[Thu Apr 23 07:31:39.839030 2026] [:error] [pid 64998:tid 65025] [client 89.251.0.147:21385] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aelaW4V5EysYcTLjmwgAcwAAAdc"]
[Thu Apr 23 07:31:41.546695 2026] [:error] [pid 59700:tid 59715] [client 89.251.0.139:43477] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aelaXZXyGZJFeAIDWtliFgAAAU0"]
[Thu Apr 23 07:31:46.403409 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.142:49243] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aelaYjEP2_5RswrH8bGykQAAABc"]
[Thu Apr 23 07:31:47.535143 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.114:65495] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aelaY4AV4GfOOdX8QzoY5gAAAYM"]
[Thu Apr 23 07:31:50.291069 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.117:56819] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aelaZjC5hrvNXosL83LWJgAAANc"]
[Thu Apr 23 07:31:55.060408 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.124:32151] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aelaazC5hrvNXosL83LWPQAAANU"]
[Thu Apr 23 07:31:58.352665 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.148:48909] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aelabr6vRb9j6psK2ZamJgAAAhQ"]
[Thu Apr 23 07:32:01.999024 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.114:53469] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aelacTEP2_5RswrH8bGy4wAAAAs"]
[Thu Apr 23 07:32:04.960676 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.137:61671] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aeladMOAb-3sOknsk4cn8AAAAEI"]
[Thu Apr 23 07:32:06.984049 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.127:43857] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aeladpXyGZJFeAIDWtliiAAAAVQ"]
[Thu Apr 23 07:32:08.991847 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.114:24755] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aelaeJXyGZJFeAIDWtliogAAAUM"]
[Thu Apr 23 07:32:09.632533 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.131:22875] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aelaeZXyGZJFeAIDWtlipwAAAUg"]
[Thu Apr 23 07:32:14.319688 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.143:48417] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aelafjC5hrvNXosL83LWwgAAAMk"]
[Thu Apr 23 07:32:15.202433 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.147:25287] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aelaf4V5EysYcTLjmwgBxAAAAcE"]
[Thu Apr 23 07:32:15.913816 2026] [:error] [pid 64998:tid 65011] [client 89.251.0.139:40771] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aelaf4V5EysYcTLjmwgBzwAAAck"]
[Thu Apr 23 07:32:17.158859 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.121:45321] [client 89.251.0.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.121, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aelagb6vRb9j6psK2ZanOgAAAg0"]
[Thu Apr 23 07:32:17.825309 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.121:45321] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aelagb6vRb9j6psK2ZanSQAAAg0"]
[Thu Apr 23 07:32:18.662031 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.123:22679] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aelagpXyGZJFeAIDWtliygAAAUA"]
[Thu Apr 23 07:32:19.376758 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.151:23969] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aelag76vRb9j6psK2ZanYgAAAgk"]
[Thu Apr 23 07:32:22.476996 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.135:35013] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aelahjEP2_5RswrH8bGzvAAAABc"]
[Thu Apr 23 07:32:26.031743 2026] [:error] [pid 43083:tid 43096] [client 89.251.0.138:33001] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aelaijC5hrvNXosL83LXGAAAAMs"]
[Thu Apr 23 07:32:27.957659 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.135:42769] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aelai4V5EysYcTLjmwgCXAAAAdY"]
[Thu Apr 23 07:32:35.752169 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.137:40875] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aelak4V5EysYcTLjmwgCxAAAAcE"]
[Thu Apr 23 07:32:36.495892 2026] [:error] [pid 64998:tid 65020] [client 89.251.0.136:49549] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aelalIV5EysYcTLjmwgC1gAAAdI"]
[Thu Apr 23 07:32:37.365431 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.136:64741] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aelalYV5EysYcTLjmwgC8gAAAdE"]
[Thu Apr 23 07:32:38.096246 2026] [:error] [pid 42971:tid 42990] [client 89.251.0.151:21987] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aelaljEP2_5RswrH8bG0KgAAAAQ"]
[Thu Apr 23 07:32:40.874481 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.144:51219] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aelamMOAb-3sOknsk4coegAAAEU"]
[Thu Apr 23 07:32:41.615194 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.124:48543] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aelamb6vRb9j6psK2ZaoZwAAAhg"]
[Thu Apr 23 07:32:44.213621 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.147:24563] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aelanDC5hrvNXosL83LXeAAAAMc"]
[Thu Apr 23 07:32:46.025038 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.126:58523] [client 89.251.0.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-help/admin/wp-fclass.php"] [unique_id "aelanr6vRb9j6psK2ZaovgAAAgk"]
[Thu Apr 23 07:32:47.832230 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.129:25003] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aelan4V5EysYcTLjmwgD8AAAAcY"]
[Thu Apr 23 07:32:48.719096 2026] [:error] [pid 43083:tid 43103] [client 89.251.0.143:24937] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aelaoDC5hrvNXosL83LXigAAANI"]
[Thu Apr 23 07:33:28.051841 2026] [autoindex:error] [pid 59700:tid 59710] [client 89.251.0.117:61231] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 08:10:28.771815 2026] [:error] [pid 43083:tid 43085] [client 120.154.156.221:57753] [client 120.154.156.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.154.156.221, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aeljdDC5hrvNXosL83LvdgAAAMA"]
[Thu Apr 23 10:34:39.754006 2026] [:error] [pid 46953:tid 46981] [client 43.166.244.66:37896] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aemFP0nlpdHh-P6wKbraFAAAAlg"]
[Thu Apr 23 12:11:57.366340 2026] [:error] [pid 42973:tid 43062] [client 84.239.37.20:3162] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcDW6I0QqmmmLTHE09CgAAAJM"]
[Thu Apr 23 12:11:58.919253 2026] [:error] [pid 42973:tid 43061] [client 84.239.37.20:65170] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcDm6I0QqmmmLTHE09DQAAAJI"]
[Thu Apr 23 12:11:59.560125 2026] [:error] [pid 42973:tid 43043] [client 84.239.37.20:3950] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcD26I0QqmmmLTHE09DgAAAIA"]
[Thu Apr 23 12:12:00.058745 2026] [:error] [pid 65000:tid 65032] [client 84.239.37.20:58106] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcEL6vRb9j6psK2ZZb9AAAAgM"]
[Thu Apr 23 12:12:01.354975 2026] [:error] [pid 65000:tid 65052] [client 84.239.37.20:47089] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcEb6vRb9j6psK2ZZb9wAAAhM"]
[Thu Apr 23 12:12:03.160795 2026] [:error] [pid 64998:tid 65021] [client 84.239.37.20:26241] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcE4V5EysYcTLjmwiz3AAAAdM"]
[Thu Apr 23 12:12:04.428289 2026] [:error] [pid 65000:tid 65057] [client 84.239.37.20:11560] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcFL6vRb9j6psK2ZZb-wAAAhg"]
[Thu Apr 23 12:12:05.072756 2026] [:error] [pid 65000:tid 65037] [client 84.239.37.20:7038] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcFb6vRb9j6psK2ZZb_wAAAgQ"]
[Thu Apr 23 12:12:05.827364 2026] [:error] [pid 42973:tid 43060] [client 84.239.37.20:55585] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcFW6I0QqmmmLTHE09EwAAAJE"]
[Thu Apr 23 12:12:06.437134 2026] [:error] [pid 42973:tid 43064] [client 84.239.37.20:55585] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcFm6I0QqmmmLTHE09FgAAAJU"]
[Thu Apr 23 12:12:07.947149 2026] [:error] [pid 46953:tid 46965] [client 84.239.37.20:20191] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcF0nlpdHh-P6wKbrjswAAAkk"]
[Thu Apr 23 12:12:09.725977 2026] [:error] [pid 42973:tid 43052] [client 84.239.37.20:58904] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcGW6I0QqmmmLTHE09HAAAAIk"]
[Thu Apr 23 12:12:10.405384 2026] [:error] [pid 65000:tid 65052] [client 84.239.37.20:58051] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/robots.txt"] [unique_id "aemcGr6vRb9j6psK2ZZcCAAAAhM"]
[Thu Apr 23 12:12:10.898939 2026] [:error] [pid 42973:tid 43065] [client 84.239.37.20:21536] [client 84.239.37.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.paramountestate.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemcGm6I0QqmmmLTHE09IAAAAJY"]
[Thu Apr 23 13:33:03.623645 2026] [:error] [pid 46953:tid 46979] [client 49.51.243.95:35838] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemvD0nlpdHh-P6wKbrwcQAAAlY"]
[Thu Apr 23 13:34:01.770366 2026] [:error] [pid 59700:tid 59724] [client 223.244.35.77:49057] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aemvSZXyGZJFeAIDWtnMUwAAAVY"]
[Thu Apr 23 16:27:15.853533 2026] [:error] [pid 65000:tid 65037] [client 20.234.16.228:65331] [client 20.234.16.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aenX476vRb9j6psK2ZbC_gAAAgQ"]
[Thu Apr 23 16:48:41.622544 2026] [ssl:error] [pid 65000:tid 65031] [client 47.128.112.54:52446] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup, referer: https://paramountestate.com/robots.txt
[Thu Apr 23 18:20:11.897061 2026] [:error] [pid 64998:tid 65025] [client 43.153.192.98:51046] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aenyW4V5EysYcTLjmwgd4wAAAdc"]
[Thu Apr 23 23:45:26.312974 2026] [autoindex:error] [pid 65000:tid 65047] [client 173.239.218.65:45317] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 00:37:46.758546 2026] [:error] [pid 59700:tid 59711] [client 103.215.237.25:63765] [client 103.215.237.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.237.25, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aepK2pXyGZJFeAIDWtlioQAAAUk"]
[Fri Apr 24 01:25:17.516376 2026] [:error] [pid 46953:tid 46960] [client 185.198.240.126:25341] [client 185.198.240.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aepV_UnlpdHh-P6wKbp0swAAAkQ"]
[Fri Apr 24 03:31:47.057454 2026] [:error] [pid 59700:tid 59706] [client 34.74.51.36:40164] [client 34.74.51.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aepzo5XyGZJFeAIDWtmNEQAAAUQ"]
[Fri Apr 24 03:59:13.995919 2026] [:error] [pid 19200:tid 19224] [client 43.166.131.228:36050] [client 43.166.131.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aep6ETQ--M3-tsKAnhFTFAAAANA"]
[Fri Apr 24 07:40:32.624447 2026] [:error] [pid 52129:tid 52148] [client 43.130.57.76:49764] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeqt8OKCZKf8_u2LKiDJIgAAAQ8"]
[Fri Apr 24 08:54:46.905334 2026] [:error] [pid 19200:tid 19231] [client 182.44.67.97:38176] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeq_VjQ--M3-tsKAnhEluAAAANc"]
[Fri Apr 24 08:59:14.311038 2026] [:error] [pid 52129:tid 52151] [client 20.238.82.232:38253] [client 20.238.82.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aerAYuKCZKf8_u2LKiAnUQAAARI"]
[Fri Apr 24 08:59:20.550067 2026] [:error] [pid 19200:tid 19208] [client 20.238.82.232:20745] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "aerAaDQ--M3-tsKAnhEqEwAAAMA"]
[Fri Apr 24 08:59:21.182611 2026] [:error] [pid 52129:tid 52153] [client 20.238.82.232:42628] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "aerAaeKCZKf8_u2LKiAnVQAAARQ"]
[Fri Apr 24 08:59:22.123391 2026] [:error] [pid 19101:tid 19159] [client 20.238.82.232:30137] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "aerAamAHj9bEvrTgbO0mrAAAAFY"]
[Fri Apr 24 08:59:22.899335 2026] [:error] [pid 19200:tid 19225] [client 20.238.82.232:4607] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cu.php"] [unique_id "aerAajQ--M3-tsKAnhEqHAAAANE"]
[Fri Apr 24 08:59:23.471500 2026] [:error] [pid 52129:tid 52145] [client 20.238.82.232:19463] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tramuibs.php"] [unique_id "aerAa-KCZKf8_u2LKiAnYAAAAQw"]
[Fri Apr 24 08:59:24.083720 2026] [:error] [pid 19200:tid 19224] [client 20.238.82.232:33910] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tramuibs.php"] [unique_id "aerAbDQ--M3-tsKAnhEqIwAAANA"]
[Fri Apr 24 08:59:24.609455 2026] [:error] [pid 52129:tid 52146] [client 20.238.82.232:42640] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tramuibs.php"] [unique_id "aerAbOKCZKf8_u2LKiAnYwAAAQ0"]
[Fri Apr 24 08:59:25.164178 2026] [:error] [pid 19102:tid 19166] [client 20.238.82.232:24017] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/tramuibs.php"] [unique_id "aerAbQDSgrbLEZbkqD4ztAAAAII"]
[Fri Apr 24 08:59:25.778181 2026] [:error] [pid 19200:tid 19227] [client 20.238.82.232:30799] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "aerAbTQ--M3-tsKAnhEqJwAAANM"]
[Fri Apr 24 08:59:26.511160 2026] [:error] [pid 52129:tid 52143] [client 20.238.82.232:36477] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "aerAbuKCZKf8_u2LKiAncgAAAQo"]
[Fri Apr 24 08:59:27.092421 2026] [:error] [pid 19102:tid 19173] [client 20.238.82.232:33878] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "aerAbwDSgrbLEZbkqD4ztwAAAIk"]
[Fri Apr 24 08:59:27.741145 2026] [:error] [pid 19100:tid 19129] [client 20.238.82.232:42625] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/19.php"] [unique_id "aerAb7F_hzQs4CqbifdblwAAABM"]
[Fri Apr 24 08:59:28.455556 2026] [:error] [pid 19100:tid 19109] [client 20.238.82.232:16343] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "aerAcLF_hzQs4CqbifdbngAAAAA"]
[Fri Apr 24 08:59:29.195289 2026] [:error] [pid 52129:tid 52143] [client 20.238.82.232:42718] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "aerAceKCZKf8_u2LKiAngAAAAQo"]
[Fri Apr 24 08:59:30.091898 2026] [:error] [pid 52129:tid 52152] [client 20.238.82.232:42646] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "aerAcuKCZKf8_u2LKiAniAAAARM"]
[Fri Apr 24 08:59:30.726490 2026] [:error] [pid 52129:tid 52140] [client 20.238.82.232:30116] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/test1.php"] [unique_id "aerAcuKCZKf8_u2LKiAnjQAAAQc"]
[Fri Apr 24 08:59:31.449714 2026] [:error] [pid 19200:tid 19213] [client 20.238.82.232:42710] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bpxrn.php"] [unique_id "aerAczQ--M3-tsKAnhEqMQAAAMU"]
[Fri Apr 24 08:59:32.125658 2026] [:error] [pid 19102:tid 19184] [client 20.238.82.232:17017] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bpxrn.php"] [unique_id "aerAdADSgrbLEZbkqD4zvAAAAJQ"]
[Fri Apr 24 08:59:32.754642 2026] [:error] [pid 19102:tid 19175] [client 20.238.82.232:16996] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bpxrn.php"] [unique_id "aerAdADSgrbLEZbkqD4zvQAAAIs"]
[Fri Apr 24 08:59:33.291625 2026] [:error] [pid 19100:tid 19128] [client 20.238.82.232:30083] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bpxrn.php"] [unique_id "aerAdbF_hzQs4CqbifdbqgAAABI"]
[Fri Apr 24 08:59:33.829945 2026] [:error] [pid 19102:tid 19178] [client 20.238.82.232:17001] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "aerAdQDSgrbLEZbkqD4zwQAAAI4"]
[Fri Apr 24 08:59:34.545977 2026] [:error] [pid 19102:tid 19164] [client 20.238.82.232:36476] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "aerAdgDSgrbLEZbkqD4zxwAAAIA"]
[Fri Apr 24 08:59:35.109919 2026] [:error] [pid 19102:tid 19174] [client 20.238.82.232:4597] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "aerAdwDSgrbLEZbkqD4zyAAAAIo"]
[Fri Apr 24 08:59:35.650585 2026] [:error] [pid 52129:tid 52139] [client 20.238.82.232:16914] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a1.php"] [unique_id "aerAd-KCZKf8_u2LKiAnngAAAQY"]
[Fri Apr 24 08:59:36.202099 2026] [:error] [pid 19102:tid 19183] [client 20.238.82.232:33857] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws37.php"] [unique_id "aerAeADSgrbLEZbkqD4zygAAAJM"]
[Fri Apr 24 08:59:36.855866 2026] [:error] [pid 52129:tid 52135] [client 20.238.82.232:24020] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws37.php"] [unique_id "aerAeOKCZKf8_u2LKiAnpgAAAQI"]
[Fri Apr 24 08:59:37.515474 2026] [:error] [pid 52129:tid 52148] [client 20.238.82.232:24037] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws37.php"] [unique_id "aerAeeKCZKf8_u2LKiAnrgAAAQ8"]
[Fri Apr 24 08:59:38.167617 2026] [:error] [pid 19102:tid 19167] [client 20.238.82.232:51012] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ws37.php"] [unique_id "aerAegDSgrbLEZbkqD4z0AAAAIM"]
[Fri Apr 24 08:59:38.781102 2026] [:error] [pid 19102:tid 19180] [client 20.238.82.232:16320] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sky.php"] [unique_id "aerAegDSgrbLEZbkqD4z0wAAAJA"]
[Fri Apr 24 08:59:39.376931 2026] [:error] [pid 52129:tid 52138] [client 20.238.82.232:16371] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sky.php"] [unique_id "aerAe-KCZKf8_u2LKiAntAAAAQU"]
[Fri Apr 24 08:59:39.980229 2026] [:error] [pid 52129:tid 52150] [client 20.238.82.232:24030] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sky.php"] [unique_id "aerAe-KCZKf8_u2LKiAnuAAAARE"]
[Fri Apr 24 08:59:40.534273 2026] [:error] [pid 19102:tid 19170] [client 20.238.82.232:33916] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sky.php"] [unique_id "aerAfADSgrbLEZbkqD4z1QAAAIY"]
[Fri Apr 24 08:59:41.229217 2026] [:error] [pid 19200:tid 19220] [client 20.238.82.232:17011] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bojcdooq.php"] [unique_id "aerAfTQ--M3-tsKAnhEqRwAAAMw"]
[Fri Apr 24 08:59:41.845979 2026] [:error] [pid 19200:tid 19225] [client 20.238.82.232:30845] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bojcdooq.php"] [unique_id "aerAfTQ--M3-tsKAnhEqSAAAANE"]
[Fri Apr 24 08:59:42.482964 2026] [:error] [pid 19100:tid 19120] [client 20.238.82.232:51051] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bojcdooq.php"] [unique_id "aerAfrF_hzQs4CqbifdbuAAAAAo"]
[Fri Apr 24 08:59:43.064133 2026] [:error] [pid 19100:tid 19109] [client 20.238.82.232:24003] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bojcdooq.php"] [unique_id "aerAf7F_hzQs4CqbifdbugAAAAA"]
[Fri Apr 24 08:59:43.579390 2026] [:error] [pid 19102:tid 19169] [client 20.238.82.232:33896] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zdd.php"] [unique_id "aerAfwDSgrbLEZbkqD4z4QAAAIU"]
[Fri Apr 24 08:59:44.141082 2026] [:error] [pid 19200:tid 19231] [client 20.238.82.232:42655] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zdd.php"] [unique_id "aerAgDQ--M3-tsKAnhEqUwAAANc"]
[Fri Apr 24 08:59:44.711431 2026] [:error] [pid 19101:tid 19149] [client 20.238.82.232:24045] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zdd.php"] [unique_id "aerAgGAHj9bEvrTgbO0m2AAAAEw"]
[Fri Apr 24 08:59:45.386165 2026] [:error] [pid 19101:tid 19147] [client 20.238.82.232:60937] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/zdd.php"] [unique_id "aerAgWAHj9bEvrTgbO0m2gAAAEo"]
[Fri Apr 24 08:59:46.016644 2026] [:error] [pid 52129:tid 52142] [client 20.238.82.232:33866] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "aerAguKCZKf8_u2LKiAnyAAAAQk"]
[Fri Apr 24 08:59:46.564455 2026] [:error] [pid 52129:tid 52154] [client 20.238.82.232:16926] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "aerAguKCZKf8_u2LKiAnygAAARU"]
[Fri Apr 24 08:59:47.376250 2026] [:error] [pid 19101:tid 19160] [client 20.238.82.232:25150] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "aerAg2AHj9bEvrTgbO0m4AAAAFc"]
[Fri Apr 24 08:59:48.264869 2026] [:error] [pid 19200:tid 19226] [client 20.238.82.232:30846] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/133.php"] [unique_id "aerAhDQ--M3-tsKAnhEqcQAAANI"]
[Fri Apr 24 08:59:48.856518 2026] [:error] [pid 19102:tid 19168] [client 20.238.82.232:36443] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jq.php"] [unique_id "aerAhADSgrbLEZbkqD4z6QAAAIQ"]
[Fri Apr 24 08:59:49.509831 2026] [:error] [pid 52129:tid 52141] [client 20.238.82.232:16358] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jq.php"] [unique_id "aerAheKCZKf8_u2LKiAn0gAAAQg"]
[Fri Apr 24 08:59:50.144876 2026] [:error] [pid 19100:tid 19129] [client 20.238.82.232:4600] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jq.php"] [unique_id "aerAhrF_hzQs4CqbifdbwwAAABM"]
[Fri Apr 24 08:59:50.728312 2026] [:error] [pid 52129:tid 52146] [client 20.238.82.232:25103] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/jq.php"] [unique_id "aerAhuKCZKf8_u2LKiAn2AAAAQ0"]
[Fri Apr 24 08:59:51.359805 2026] [:error] [pid 19100:tid 19111] [client 20.238.82.232:24025] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cro.php"] [unique_id "aerAh7F_hzQs4CqbifdbxQAAAAI"]
[Fri Apr 24 08:59:51.941687 2026] [:error] [pid 52129:tid 52145] [client 20.238.82.232:33869] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cro.php"] [unique_id "aerAh-KCZKf8_u2LKiAn4QAAAQw"]
[Fri Apr 24 08:59:52.492726 2026] [:error] [pid 19100:tid 19113] [client 20.238.82.232:30826] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cro.php"] [unique_id "aerAiLF_hzQs4CqbifdbyAAAAAQ"]
[Fri Apr 24 08:59:53.118259 2026] [:error] [pid 19102:tid 19171] [client 20.238.82.232:42716] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cro.php"] [unique_id "aerAiQDSgrbLEZbkqD4z7QAAAIc"]
[Fri Apr 24 08:59:53.759135 2026] [:error] [pid 19102:tid 19178] [client 20.238.82.232:16297] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wwx.php"] [unique_id "aerAiQDSgrbLEZbkqD4z7gAAAI4"]
[Fri Apr 24 08:59:54.269351 2026] [:error] [pid 19100:tid 19133] [client 20.238.82.232:34527] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wwx.php"] [unique_id "aerAirF_hzQs4CqbifdbzwAAABc"]
[Fri Apr 24 08:59:54.819997 2026] [:error] [pid 19101:tid 19160] [client 20.238.82.232:24054] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wwx.php"] [unique_id "aerAimAHj9bEvrTgbO0m5wAAAFc"]
[Fri Apr 24 08:59:55.393812 2026] [:error] [pid 19100:tid 19129] [client 20.238.82.232:34547] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wwx.php"] [unique_id "aerAi7F_hzQs4Cqbifdb0wAAABM"]
[Fri Apr 24 08:59:55.932063 2026] [:error] [pid 19101:tid 19148] [client 20.238.82.232:52295] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "aerAi2AHj9bEvrTgbO0m6wAAAEs"]
[Fri Apr 24 08:59:56.439155 2026] [:error] [pid 52129:tid 52136] [client 20.238.82.232:5039] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "aerAjOKCZKf8_u2LKiAn7AAAAQM"]
[Fri Apr 24 08:59:56.969536 2026] [:error] [pid 52129:tid 52137] [client 20.238.82.232:16274] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "aerAjOKCZKf8_u2LKiAn8gAAAQQ"]
[Fri Apr 24 08:59:57.609076 2026] [:error] [pid 19102:tid 19173] [client 20.238.82.232:34504] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/trx24.php"] [unique_id "aerAjQDSgrbLEZbkqD4z9AAAAIk"]
[Fri Apr 24 08:59:58.265213 2026] [:error] [pid 19200:tid 19211] [client 20.238.82.232:5051] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blox.php"] [unique_id "aerAjjQ--M3-tsKAnhEqrAAAAMM"]
[Fri Apr 24 08:59:59.888363 2026] [:error] [pid 19101:tid 19155] [client 20.238.82.232:60017] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blox.php"] [unique_id "aerAj2AHj9bEvrTgbO0m7gAAAFI"]
[Fri Apr 24 09:00:00.925595 2026] [:error] [pid 19200:tid 19226] [client 20.238.82.232:5088] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blox.php"] [unique_id "aerAkDQ--M3-tsKAnhEqvAAAANI"]
[Fri Apr 24 09:00:01.801269 2026] [:error] [pid 19102:tid 19176] [client 20.238.82.232:59985] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/blox.php"] [unique_id "aerAkQDSgrbLEZbkqD40BAAAAIw"]
[Fri Apr 24 09:00:02.463819 2026] [:error] [pid 19200:tid 19224] [client 20.238.82.232:44721] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berax.php"] [unique_id "aerAkjQ--M3-tsKAnhEqzQAAANA"]
[Fri Apr 24 09:00:03.176780 2026] [:error] [pid 52129:tid 52133] [client 20.238.82.232:17619] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berax.php"] [unique_id "aerAk-KCZKf8_u2LKiAn_AAAAQA"]
[Fri Apr 24 09:00:04.003600 2026] [:error] [pid 52129:tid 52140] [client 20.238.82.232:38690] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berax.php"] [unique_id "aerAlOKCZKf8_u2LKiAoAQAAAQc"]
[Fri Apr 24 09:00:04.778455 2026] [:error] [pid 19102:tid 19181] [client 20.238.82.232:21412] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/berax.php"] [unique_id "aerAlADSgrbLEZbkqD40CgAAAJE"]
[Fri Apr 24 09:00:05.550605 2026] [:error] [pid 19102:tid 19167] [client 20.238.82.232:14138] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bkxzo.php"] [unique_id "aerAlQDSgrbLEZbkqD40DQAAAIM"]
[Fri Apr 24 09:00:06.528582 2026] [:error] [pid 52129:tid 52145] [client 20.238.82.232:20183] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bkxzo.php"] [unique_id "aerAluKCZKf8_u2LKiAoFwAAAQw"]
[Fri Apr 24 09:00:07.072547 2026] [:error] [pid 19101:tid 19149] [client 20.238.82.232:56612] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bkxzo.php"] [unique_id "aerAl2AHj9bEvrTgbO0m-wAAAEw"]
[Fri Apr 24 09:00:07.804779 2026] [:error] [pid 52129:tid 52133] [client 20.238.82.232:4445] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bkxzo.php"] [unique_id "aerAl-KCZKf8_u2LKiAoIQAAAQA"]
[Fri Apr 24 09:00:08.453699 2026] [:error] [pid 52129:tid 52143] [client 20.238.82.232:29002] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cdxadmin.php"] [unique_id "aerAmOKCZKf8_u2LKiAoJAAAAQo"]
[Fri Apr 24 09:00:09.123962 2026] [:error] [pid 52129:tid 52145] [client 20.238.82.232:15223] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cdxadmin.php"] [unique_id "aerAmeKCZKf8_u2LKiAoKQAAAQw"]
[Fri Apr 24 09:00:09.696830 2026] [:error] [pid 52129:tid 52153] [client 20.238.82.232:4597] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cdxadmin.php"] [unique_id "aerAmeKCZKf8_u2LKiAoMAAAARQ"]
[Fri Apr 24 09:00:10.381375 2026] [:error] [pid 19101:tid 19142] [client 20.238.82.232:41016] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cdxadmin.php"] [unique_id "aerAmmAHj9bEvrTgbO0nBQAAAEU"]
[Fri Apr 24 09:00:11.181648 2026] [:error] [pid 52129:tid 52151] [client 20.238.82.232:13626] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dfre.php"] [unique_id "aerAm-KCZKf8_u2LKiAoOgAAARI"]
[Fri Apr 24 09:00:11.763853 2026] [:error] [pid 52129:tid 52153] [client 20.238.82.232:15191] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dfre.php"] [unique_id "aerAm-KCZKf8_u2LKiAoPQAAARQ"]
[Fri Apr 24 09:00:12.352800 2026] [:error] [pid 52129:tid 52143] [client 20.238.82.232:45590] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dfre.php"] [unique_id "aerAnOKCZKf8_u2LKiAoQQAAAQo"]
[Fri Apr 24 09:00:12.927267 2026] [:error] [pid 19200:tid 19228] [client 20.238.82.232:13612] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/dfre.php"] [unique_id "aerAnDQ--M3-tsKAnhErEAAAANQ"]
[Fri Apr 24 09:00:13.556700 2026] [:error] [pid 52129:tid 52154] [client 20.238.82.232:42025] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/sko.php"] [unique_id "aerAneKCZKf8_u2LKiAoRgAAARU"]
[Fri Apr 24 09:00:33.538871 2026] [:error] [pid 52129:tid 52149] [client 20.238.82.232:23299] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/redixsx.php"] [unique_id "aerAseKCZKf8_u2LKiApHgAAARA"]
[Fri Apr 24 09:00:34.122122 2026] [:error] [pid 19101:tid 19145] [client 20.238.82.232:27053] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/redixsx.php"] [unique_id "aerAsmAHj9bEvrTgbO0nPgAAAEg"]
[Fri Apr 24 09:00:34.767477 2026] [:error] [pid 19101:tid 19157] [client 20.238.82.232:17560] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/redixsx.php"] [unique_id "aerAsmAHj9bEvrTgbO0nQwAAAFQ"]
[Fri Apr 24 09:00:35.443045 2026] [:error] [pid 19200:tid 19215] [client 20.238.82.232:59433] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "aerAszQ--M3-tsKAnhErjQAAAMc"]
[Fri Apr 24 09:00:36.212974 2026] [:error] [pid 19100:tid 19124] [client 20.238.82.232:20863] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "aerAtLF_hzQs4CqbifdcAQAAAA4"]
[Fri Apr 24 09:00:36.734795 2026] [:error] [pid 19102:tid 19171] [client 20.238.82.232:25739] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "aerAtADSgrbLEZbkqD40NwAAAIc"]
[Fri Apr 24 09:00:37.359340 2026] [:error] [pid 19101:tid 19142] [client 20.238.82.232:14179] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/alpha.php"] [unique_id "aerAtWAHj9bEvrTgbO0nSQAAAEU"]
[Fri Apr 24 09:00:37.906166 2026] [:error] [pid 52129:tid 52144] [client 20.238.82.232:20816] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bc.php"] [unique_id "aerAteKCZKf8_u2LKiApNAAAAQs"]
[Fri Apr 24 09:00:38.440160 2026] [:error] [pid 52129:tid 52133] [client 20.238.82.232:41394] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bc.php"] [unique_id "aerAtuKCZKf8_u2LKiApPAAAAQA"]
[Fri Apr 24 09:00:39.095696 2026] [:error] [pid 52129:tid 52153] [client 20.238.82.232:4394] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bc.php"] [unique_id "aerAt-KCZKf8_u2LKiApRwAAARQ"]
[Fri Apr 24 09:00:39.729376 2026] [:error] [pid 19200:tid 19214] [client 20.238.82.232:41358] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bc.php"] [unique_id "aerAtzQ--M3-tsKAnhErlAAAAMY"]
[Fri Apr 24 09:00:40.389319 2026] [:error] [pid 19102:tid 19176] [client 20.238.82.232:14184] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/67.php"] [unique_id "aerAuADSgrbLEZbkqD40PAAAAIw"]
[Fri Apr 24 09:00:40.930577 2026] [:error] [pid 52129:tid 52146] [client 20.238.82.232:33822] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/67.php"] [unique_id "aerAuOKCZKf8_u2LKiApVwAAAQ0"]
[Fri Apr 24 09:00:41.445423 2026] [:error] [pid 52129:tid 52149] [client 20.238.82.232:25749] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/67.php"] [unique_id "aerAueKCZKf8_u2LKiApWwAAARA"]
[Fri Apr 24 09:00:42.056405 2026] [:error] [pid 19200:tid 19213] [client 20.238.82.232:4706] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/67.php"] [unique_id "aerAujQ--M3-tsKAnhErmAAAAMU"]
[Fri Apr 24 09:00:42.607656 2026] [:error] [pid 19200:tid 19216] [client 20.238.82.232:52901] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1mrX.php"] [unique_id "aerAujQ--M3-tsKAnhErnAAAAMg"]
[Fri Apr 24 09:00:43.263042 2026] [:error] [pid 19100:tid 19119] [client 20.238.82.232:50451] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1mrX.php"] [unique_id "aerAu7F_hzQs4CqbifdcCwAAAAk"]
[Fri Apr 24 09:00:43.789639 2026] [:error] [pid 19102:tid 19183] [client 20.238.82.232:63993] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1mrX.php"] [unique_id "aerAuwDSgrbLEZbkqD40QQAAAJM"]
[Fri Apr 24 09:00:44.457902 2026] [:error] [pid 19100:tid 19131] [client 20.238.82.232:14173] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1mrX.php"] [unique_id "aerAvLF_hzQs4CqbifdcDwAAABU"]
[Fri Apr 24 09:00:45.027579 2026] [:error] [pid 19102:tid 19164] [client 20.238.82.232:4196] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x402.php"] [unique_id "aerAvQDSgrbLEZbkqD40RwAAAIA"]
[Fri Apr 24 09:00:45.731460 2026] [:error] [pid 19102:tid 19166] [client 20.238.82.232:4191] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x402.php"] [unique_id "aerAvQDSgrbLEZbkqD40UAAAAII"]
[Fri Apr 24 09:00:46.280222 2026] [:error] [pid 19200:tid 19232] [client 20.238.82.232:22054] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x402.php"] [unique_id "aerAvjQ--M3-tsKAnhErogAAANg"]
[Fri Apr 24 09:00:46.970739 2026] [:error] [pid 19102:tid 19179] [client 20.238.82.232:4171] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/x402.php"] [unique_id "aerAvgDSgrbLEZbkqD40VwAAAI8"]
[Fri Apr 24 09:00:47.594817 2026] [:error] [pid 19102:tid 19185] [client 20.238.82.232:60665] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/485.php"] [unique_id "aerAvwDSgrbLEZbkqD40WgAAAJU"]
[Fri Apr 24 09:00:48.167409 2026] [:error] [pid 19101:tid 19143] [client 20.238.82.232:4339] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/485.php"] [unique_id "aerAwGAHj9bEvrTgbO0nWAAAAEY"]
[Fri Apr 24 09:00:48.765561 2026] [:error] [pid 52129:tid 52143] [client 20.238.82.232:18904] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/485.php"] [unique_id "aerAwOKCZKf8_u2LKiApZAAAAQo"]
[Fri Apr 24 09:00:49.306509 2026] [:error] [pid 19101:tid 19152] [client 20.238.82.232:23967] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/485.php"] [unique_id "aerAwWAHj9bEvrTgbO0nXAAAAE8"]
[Fri Apr 24 09:00:49.836345 2026] [:error] [pid 19101:tid 19148] [client 20.238.82.232:50474] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aerAwWAHj9bEvrTgbO0nYgAAAEs"]
[Fri Apr 24 09:00:50.375840 2026] [:error] [pid 19102:tid 19188] [client 20.238.82.232:41406] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aerAwgDSgrbLEZbkqD40YQAAAJg"]
[Fri Apr 24 09:00:51.042367 2026] [:error] [pid 19101:tid 19146] [client 20.238.82.232:60621] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aerAw2AHj9bEvrTgbO0naAAAAEk"]
[Fri Apr 24 09:00:51.587324 2026] [:error] [pid 52129:tid 52142] [client 20.238.82.232:40037] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aerAw-KCZKf8_u2LKiApbQAAAQk"]
[Fri Apr 24 09:00:52.308765 2026] [:error] [pid 52129:tid 52155] [client 20.238.82.232:18839] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aerAxOKCZKf8_u2LKiApcQAAARY"]
[Fri Apr 24 09:00:52.991383 2026] [:error] [pid 52129:tid 52134] [client 20.238.82.232:60631] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aerAxOKCZKf8_u2LKiApdgAAAQE"]
[Fri Apr 24 09:00:53.671267 2026] [:error] [pid 19200:tid 19229] [client 20.238.82.232:18934] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aerAxTQ--M3-tsKAnhErugAAANU"]
[Fri Apr 24 09:00:54.288376 2026] [:error] [pid 52129:tid 52133] [client 20.238.82.232:53693] [client 20.238.82.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aerAxuKCZKf8_u2LKiApfgAAAQA"]
[Fri Apr 24 15:54:22.793365 2026] [:error] [pid 17808:tid 17824] [client 182.44.12.37:36898] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeshruarbOEFI8qshvLC7wAAAE4"]
[Fri Apr 24 15:59:58.697607 2026] [:error] [pid 17721:tid 17782] [client 202.57.30.210:58574] [client 202.57.30.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.57.30.210, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aesi_uFXXkLeyDnfk__yIAAAAAE"]
[Fri Apr 24 16:03:33.937120 2026] [:error] [pid 17719:tid 17740] [client 155.2.215.109:51457] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aesj1cTZ9gzEyL1BkPpsmAAAAI0"]
[Fri Apr 24 16:03:36.696094 2026] [:error] [pid 17720:tid 17776] [client 142.111.152.192:38757] [client 142.111.152.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aesj2OhlUs6BS3Ng7_UWjQAAANY"]
[Fri Apr 24 16:03:39.509300 2026] [:error] [pid 17720:tid 17774] [client 142.111.152.238:60649] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aesj2-hlUs6BS3Ng7_UWmAAAANQ"]
[Fri Apr 24 16:03:40.876947 2026] [:error] [pid 17808:tid 17823] [client 142.111.152.186:60843] [client 142.111.152.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "aesj3OarbOEFI8qshvLGXgAAAE0"]
[Fri Apr 24 16:03:43.670206 2026] [:error] [pid 17808:tid 17825] [client 155.2.215.103:63899] [client 155.2.215.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aesj3-arbOEFI8qshvLGcgAAAE8"]
[Fri Apr 24 16:03:44.905416 2026] [:error] [pid 17808:tid 17826] [client 142.111.152.77:45521] [client 142.111.152.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aesj4OarbOEFI8qshvLGdAAAAFA"]
[Fri Apr 24 16:03:45.802128 2026] [:error] [pid 17808:tid 17814] [client 142.111.152.198:60073] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aesj4earbOEFI8qshvLGdgAAAEQ"]
[Fri Apr 24 16:03:46.429581 2026] [:error] [pid 14531:tid 14555] [client 155.2.215.113:57907] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aesj4nfLU2gw-6KR-GZukwAAAVY"]
[Fri Apr 24 16:03:47.300420 2026] [:error] [pid 17720:tid 17759] [client 155.2.215.102:48811] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aesj4-hlUs6BS3Ng7_UWngAAAMU"]
[Fri Apr 24 16:03:48.017753 2026] [:error] [pid 17720:tid 17756] [client 142.111.152.82:52929] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aesj5OhlUs6BS3Ng7_UWogAAAMI"]
[Fri Apr 24 16:03:48.866756 2026] [:error] [pid 17720:tid 17768] [client 142.111.152.189:56011] [client 142.111.152.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aesj5OhlUs6BS3Ng7_UWqwAAAM4"]
[Fri Apr 24 16:03:51.280326 2026] [:error] [pid 17720:tid 17767] [client 142.111.152.188:61129] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "aesj5-hlUs6BS3Ng7_UWuAAAAM0"]
[Fri Apr 24 16:03:52.311945 2026] [:error] [pid 17808:tid 17825] [client 155.2.215.99:53837] [client 155.2.215.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aesj6OarbOEFI8qshvLGggAAAE8"]
[Fri Apr 24 16:03:53.066089 2026] [:error] [pid 17720:tid 17778] [client 155.2.215.115:48047] [client 155.2.215.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aesj6ehlUs6BS3Ng7_UWvgAAANg"]
[Fri Apr 24 16:03:54.846195 2026] [:error] [pid 14531:tid 14548] [client 142.111.152.202:36245] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aesj6nfLU2gw-6KR-GZuoAAAAU8"]
[Fri Apr 24 16:03:57.278202 2026] [:error] [pid 17720:tid 17760] [client 142.111.152.76:45103] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aesj7ehlUs6BS3Ng7_UWzAAAAMY"]
[Fri Apr 24 16:03:58.066648 2026] [:error] [pid 14531:tid 14544] [client 155.2.215.100:48237] [client 155.2.215.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aesj7nfLU2gw-6KR-GZupQAAAUs"]
[Fri Apr 24 16:03:59.057956 2026] [:error] [pid 22114:tid 22141] [client 142.111.152.83:30895] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "aesj74AuWGz3WlMQjoe51QAAARg"]
[Fri Apr 24 16:03:59.830910 2026] [:error] [pid 17808:tid 17834] [client 142.111.152.86:34223] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aesj7-arbOEFI8qshvLGjwAAAFg"]
[Fri Apr 24 16:04:01.510566 2026] [:error] [pid 17719:tid 17734] [client 142.111.152.81:54195] [client 142.111.152.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aesj8cTZ9gzEyL1BkPpsvQAAAIc"]
[Fri Apr 24 16:04:02.662464 2026] [:error] [pid 17808:tid 17816] [client 142.111.152.198:63601] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aesj8uarbOEFI8qshvLGlQAAAEY"]
[Fri Apr 24 16:04:03.948655 2026] [:error] [pid 17721:tid 17799] [client 142.111.152.87:35825] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aesj8-FXXkLeyDnfk__zLgAAABI"]
[Fri Apr 24 16:04:04.664720 2026] [:error] [pid 17721:tid 17794] [client 142.111.152.198:41293] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aesj9OFXXkLeyDnfk__zMAAAAA0"]
[Fri Apr 24 16:04:05.254013 2026] [:error] [pid 17721:tid 17802] [client 142.111.152.78:56095] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aesj9eFXXkLeyDnfk__zMwAAABU"]
[Fri Apr 24 16:04:07.113631 2026] [:error] [pid 17721:tid 17791] [client 142.111.152.77:45661] [client 142.111.152.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aesj9-FXXkLeyDnfk__zOgAAAAo"]
[Fri Apr 24 16:04:07.954163 2026] [:error] [pid 17720:tid 17775] [client 142.111.152.197:51555] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class.api.php"] [unique_id "aesj9-hlUs6BS3Ng7_UW1wAAANU"]
[Fri Apr 24 16:04:08.610563 2026] [:error] [pid 17808:tid 17827] [client 155.2.215.102:32163] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aesj-OarbOEFI8qshvLGnwAAAFE"]
[Fri Apr 24 16:04:11.276655 2026] [:error] [pid 17808:tid 17830] [client 155.2.215.96:44725] [client 155.2.215.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/admin.php"] [unique_id "aesj--arbOEFI8qshvLGrwAAAFQ"]
[Fri Apr 24 16:04:13.432222 2026] [:error] [pid 17719:tid 17728] [client 142.111.152.76:62253] [client 142.111.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.76, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aesj_cTZ9gzEyL1BkPps4QAAAIE"]
[Fri Apr 24 16:04:16.611440 2026] [:error] [pid 17719:tid 17731] [client 142.111.152.76:62253] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aeskAMTZ9gzEyL1BkPps7wAAAIQ"]
[Fri Apr 24 16:04:17.909356 2026] [:error] [pid 22114:tid 22117] [client 142.111.152.77:46287] [client 142.111.152.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.77, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aeskAYAuWGz3WlMQjoe55QAAAQA"]
[Fri Apr 24 16:04:18.435153 2026] [:error] [pid 22114:tid 22135] [client 142.111.152.77:46287] [client 142.111.152.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/item.php"] [unique_id "aeskAoAuWGz3WlMQjoe55wAAARI"]
[Fri Apr 24 16:04:21.284792 2026] [:error] [pid 17808:tid 17817] [client 155.2.215.104:57875] [client 155.2.215.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aeskBearbOEFI8qshvLG3wAAAEc"]
[Fri Apr 24 16:04:23.920730 2026] [:error] [pid 17719:tid 17750] [client 142.111.152.88:50765] [client 142.111.152.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeskB8TZ9gzEyL1BkPps_wAAAJc"]
[Fri Apr 24 16:04:24.943930 2026] [:error] [pid 14531:tid 14555] [client 142.111.152.194:52349] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeskCHfLU2gw-6KR-GZuzwAAAVY"]
[Fri Apr 24 16:04:26.286540 2026] [:error] [pid 17720:tid 17754] [client 155.2.215.111:20427] [client 155.2.215.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.2.215.111, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aeskCuhlUs6BS3Ng7_UW6AAAAMA"]
[Fri Apr 24 16:04:26.537293 2026] [:error] [pid 17720:tid 17764] [client 155.2.215.111:20427] [client 155.2.215.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeskCuhlUs6BS3Ng7_UW7AAAAMo"]
[Fri Apr 24 16:04:31.735407 2026] [:error] [pid 17720:tid 17761] [client 142.111.152.192:62971] [client 142.111.152.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeskD-hlUs6BS3Ng7_UXGwAAAMc"]
[Fri Apr 24 16:04:33.035500 2026] [:error] [pid 17808:tid 17813] [client 155.2.215.114:24447] [client 155.2.215.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.2.215.114, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeskEearbOEFI8qshvLG-QAAAEM"]
[Fri Apr 24 16:04:35.020322 2026] [:error] [pid 17808:tid 17815] [client 155.2.215.114:24447] [client 155.2.215.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aeskE-arbOEFI8qshvLG_gAAAEU"]
[Fri Apr 24 16:04:36.282687 2026] [:error] [pid 17721:tid 17787] [client 155.2.215.114:64603] [client 155.2.215.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/infi.php"] [unique_id "aeskFOFXXkLeyDnfk__zUwAAAAY"]
[Fri Apr 24 16:04:37.753185 2026] [:error] [pid 17719:tid 17751] [client 142.111.152.194:62679] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeskFcTZ9gzEyL1BkPptDgAAAJg"]
[Fri Apr 24 16:04:39.217044 2026] [:error] [pid 17719:tid 17735] [client 142.111.152.80:62403] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeskF8TZ9gzEyL1BkPptFAAAAIg"]
[Fri Apr 24 16:04:40.856973 2026] [:error] [pid 17720:tid 17758] [client 142.111.152.202:54619] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeskGOhlUs6BS3Ng7_UXLwAAAMQ"]
[Fri Apr 24 16:04:42.667722 2026] [:error] [pid 17720:tid 17758] [client 155.2.215.113:60149] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeskGuhlUs6BS3Ng7_UXPgAAAMQ"]
[Fri Apr 24 16:04:43.497010 2026] [:error] [pid 17720:tid 17778] [client 142.111.152.87:63173] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeskG-hlUs6BS3Ng7_UXRAAAANg"]
[Fri Apr 24 16:04:44.927066 2026] [:error] [pid 17720:tid 17758] [client 142.111.152.202:52921] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit.php"] [unique_id "aeskHOhlUs6BS3Ng7_UXTQAAAMQ"]
[Fri Apr 24 16:04:46.196689 2026] [:error] [pid 17720:tid 17759] [client 142.111.152.198:38195] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeskHuhlUs6BS3Ng7_UXVAAAAMU"]
[Fri Apr 24 16:04:47.277879 2026] [:error] [pid 17808:tid 17827] [client 155.2.215.114:43959] [client 155.2.215.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/click.php"] [unique_id "aeskH-arbOEFI8qshvLHCgAAAFE"]
[Fri Apr 24 16:04:48.732955 2026] [:error] [pid 17720:tid 17757] [client 142.111.152.185:57323] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeskIOhlUs6BS3Ng7_UXYAAAAMM"]
[Fri Apr 24 16:04:51.089158 2026] [:error] [pid 17720:tid 17773] [client 142.111.152.194:28511] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeskI-hlUs6BS3Ng7_UXbgAAANM"]
[Fri Apr 24 16:04:51.659350 2026] [:error] [pid 14531:tid 14538] [client 142.111.152.78:48377] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aeskI3fLU2gw-6KR-GZu-QAAAUU"]
[Fri Apr 24 16:04:52.145030 2026] [:error] [pid 17719:tid 17744] [client 142.111.152.197:58181] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aeskJMTZ9gzEyL1BkPptIwAAAJE"]
[Fri Apr 24 16:04:52.651208 2026] [:error] [pid 17808:tid 17826] [client 142.111.152.197:30337] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aeskJOarbOEFI8qshvLHEQAAAFA"]
[Fri Apr 24 16:04:53.516515 2026] [:error] [pid 14531:tid 14554] [client 142.111.152.200:52327] [client 142.111.152.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aeskJXfLU2gw-6KR-GZu_gAAAVU"]
[Fri Apr 24 16:04:54.046178 2026] [:error] [pid 14531:tid 14552] [client 142.111.152.238:52923] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aeskJnfLU2gw-6KR-GZvAQAAAVM"]
[Fri Apr 24 16:04:55.406982 2026] [:error] [pid 14531:tid 14547] [client 155.2.215.97:37575] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeskJ3fLU2gw-6KR-GZvCAAAAU4"]
[Fri Apr 24 16:04:56.917825 2026] [:error] [pid 17720:tid 17769] [client 155.2.215.100:47453] [client 155.2.215.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aeskKOhlUs6BS3Ng7_UXdgAAAM8"]
[Fri Apr 24 16:04:57.416837 2026] [:error] [pid 17719:tid 17737] [client 142.111.152.195:26453] [client 142.111.152.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aeskKcTZ9gzEyL1BkPptKgAAAIo"]
[Fri Apr 24 16:04:57.975980 2026] [:error] [pid 17808:tid 17825] [client 142.111.152.76:45541] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aeskKearbOEFI8qshvLHFwAAAE8"]
[Fri Apr 24 16:04:58.743403 2026] [:error] [pid 17719:tid 17747] [client 142.111.152.80:44909] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aeskKsTZ9gzEyL1BkPptMQAAAJQ"]
[Fri Apr 24 16:04:59.801332 2026] [:error] [pid 17808:tid 17829] [client 155.2.215.111:43055] [client 155.2.215.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aeskK-arbOEFI8qshvLHHAAAAFM"]
[Fri Apr 24 16:05:01.488879 2026] [:error] [pid 17721:tid 17792] [client 155.2.215.97:24531] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aeskLeFXXkLeyDnfk__zbAAAAAs"]
[Fri Apr 24 16:05:04.181562 2026] [:error] [pid 17720:tid 17776] [client 142.111.152.188:41333] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aeskMOhlUs6BS3Ng7_UXqgAAANY"]
[Fri Apr 24 16:05:05.813039 2026] [:error] [pid 17808:tid 17811] [client 142.111.152.76:26519] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aeskMearbOEFI8qshvLHKgAAAEE"]
[Fri Apr 24 16:05:06.805095 2026] [:error] [pid 17808:tid 17834] [client 155.2.215.112:60025] [client 155.2.215.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aeskMuarbOEFI8qshvLHLAAAAFg"]
[Fri Apr 24 16:05:08.652854 2026] [:error] [pid 17808:tid 17814] [client 155.2.215.111:33053] [client 155.2.215.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aeskNOarbOEFI8qshvLHOAAAAEQ"]
[Fri Apr 24 16:05:11.816671 2026] [proxy_fcgi:error] [pid 17808:tid 17812] [client 142.111.152.194:42843] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:05:12.078848 2026] [proxy_fcgi:error] [pid 17808:tid 17833] [client 142.111.152.194:42843] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:05:12.327779 2026] [proxy_fcgi:error] [pid 17808:tid 17828] [client 142.111.152.194:42843] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:05:13.754341 2026] [:error] [pid 17808:tid 17820] [client 142.111.152.194:42843] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aeskOearbOEFI8qshvLHVgAAAEo"]
[Fri Apr 24 16:05:14.288313 2026] [:error] [pid 17808:tid 17831] [client 155.2.215.98:56659] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aeskOuarbOEFI8qshvLHWAAAAFU"]
[Fri Apr 24 16:05:14.813964 2026] [:error] [pid 17720:tid 17757] [client 155.2.215.109:65481] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aeskOuhlUs6BS3Ng7_UXxwAAAMM"]
[Fri Apr 24 16:05:15.400250 2026] [:error] [pid 17808:tid 17832] [client 155.2.215.114:34233] [client 155.2.215.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aeskO-arbOEFI8qshvLHWwAAAFY"]
[Fri Apr 24 16:05:15.982777 2026] [:error] [pid 17720:tid 17772] [client 142.111.152.198:24807] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aeskO-hlUs6BS3Ng7_UXzwAAANI"]
[Fri Apr 24 16:05:16.618658 2026] [:error] [pid 17808:tid 17831] [client 155.2.215.97:60485] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aeskPOarbOEFI8qshvLHXgAAAFU"]
[Fri Apr 24 16:05:17.449323 2026] [:error] [pid 22114:tid 22127] [client 142.111.152.87:33653] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aeskPYAuWGz3WlMQjoe6BQAAAQo"]
[Fri Apr 24 16:05:17.979338 2026] [:error] [pid 17720:tid 17765] [client 142.111.152.88:49939] [client 142.111.152.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aeskPehlUs6BS3Ng7_UX3AAAAMs"]
[Fri Apr 24 16:05:18.501737 2026] [:error] [pid 14531:tid 14557] [client 142.111.152.79:59093] [client 142.111.152.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aeskPnfLU2gw-6KR-GZvGAAAAVg"]
[Fri Apr 24 16:05:20.649230 2026] [:error] [pid 17720:tid 17775] [client 142.111.152.203:34455] [client 142.111.152.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aeskQOhlUs6BS3Ng7_UX4gAAANU"]
[Fri Apr 24 16:05:21.691542 2026] [:error] [pid 17720:tid 17759] [client 142.111.152.188:32057] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aeskQehlUs6BS3Ng7_UX6QAAAMU"]
[Fri Apr 24 16:05:22.555092 2026] [:error] [pid 17720:tid 17758] [client 142.111.152.186:28171] [client 142.111.152.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aeskQuhlUs6BS3Ng7_UX8QAAAMQ"]
[Fri Apr 24 16:05:23.893252 2026] [:error] [pid 17720:tid 17769] [client 155.2.215.109:56835] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aeskQ-hlUs6BS3Ng7_UX-QAAAM8"]
[Fri Apr 24 16:05:24.973875 2026] [:error] [pid 17720:tid 17760] [client 142.111.152.82:43331] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/about.php"] [unique_id "aeskROhlUs6BS3Ng7_UYAAAAAMY"]
[Fri Apr 24 16:05:26.380146 2026] [:error] [pid 17719:tid 17740] [client 142.111.152.200:27107] [client 142.111.152.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aeskRsTZ9gzEyL1BkPptVQAAAI0"]
[Fri Apr 24 16:05:27.921104 2026] [:error] [pid 17721:tid 17782] [client 142.111.152.188:34555] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aeskR-FXXkLeyDnfk__zgwAAAAE"]
[Fri Apr 24 16:05:29.350052 2026] [:error] [pid 17808:tid 17831] [client 155.2.215.104:42877] [client 155.2.215.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aeskSearbOEFI8qshvLHZAAAAFU"]
[Fri Apr 24 16:05:34.322379 2026] [:error] [pid 17720:tid 17777] [client 155.2.215.107:50205] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aeskTuhlUs6BS3Ng7_UYJwAAANc"]
[Fri Apr 24 16:05:34.839409 2026] [:error] [pid 17808:tid 17825] [client 155.2.215.99:48437] [client 155.2.215.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aeskTuarbOEFI8qshvLHbwAAAE8"]
[Fri Apr 24 16:05:35.630483 2026] [:error] [pid 17808:tid 17810] [client 142.111.152.238:55311] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aeskT-arbOEFI8qshvLHcwAAAEA"]
[Fri Apr 24 16:05:36.766834 2026] [:error] [pid 17721:tid 17789] [client 155.2.215.109:46331] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aeskUOFXXkLeyDnfk__zjwAAAAg"]
[Fri Apr 24 16:05:37.270104 2026] [:error] [pid 17721:tid 17802] [client 155.2.215.109:35859] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aeskUeFXXkLeyDnfk__zkgAAABU"]
[Fri Apr 24 16:05:38.838691 2026] [:error] [pid 14531:tid 14554] [client 142.111.152.185:29563] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeskUnfLU2gw-6KR-GZvOwAAAVU"]
[Fri Apr 24 16:05:39.417914 2026] [:error] [pid 17720:tid 17775] [client 142.111.152.85:22049] [client 142.111.152.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aeskU-hlUs6BS3Ng7_UYKAAAANU"]
[Fri Apr 24 16:05:41.253396 2026] [:error] [pid 17720:tid 17761] [client 142.111.152.186:47185] [client 142.111.152.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aeskVehlUs6BS3Ng7_UYMQAAAMc"]
[Fri Apr 24 16:05:41.989556 2026] [proxy_fcgi:error] [pid 17720:tid 17772] [client 142.111.152.87:20697] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:05:42.896801 2026] [:error] [pid 17720:tid 17757] [client 142.111.152.87:20697] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/function.php"] [unique_id "aeskVuhlUs6BS3Ng7_UYOQAAAMM"]
[Fri Apr 24 16:05:43.894519 2026] [:error] [pid 17720:tid 17769] [client 155.2.215.112:21737] [client 155.2.215.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugins.php"] [unique_id "aeskV-hlUs6BS3Ng7_UYPgAAAM8"]
[Fri Apr 24 16:05:44.882970 2026] [:error] [pid 17719:tid 17733] [client 155.2.215.113:22519] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aeskWMTZ9gzEyL1BkPptZAAAAIY"]
[Fri Apr 24 16:05:45.700113 2026] [:error] [pid 17808:tid 17814] [client 142.111.152.86:51615] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aeskWearbOEFI8qshvLHhAAAAEQ"]
[Fri Apr 24 16:05:48.043791 2026] [:error] [pid 17720:tid 17778] [client 142.111.152.185:49277] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aeskXOhlUs6BS3Ng7_UYTQAAANg"]
[Fri Apr 24 16:05:48.552314 2026] [:error] [pid 22114:tid 22128] [client 142.111.152.76:45321] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aeskXIAuWGz3WlMQjoe6GAAAAQs"]
[Fri Apr 24 16:05:50.166495 2026] [:error] [pid 17720:tid 17775] [client 142.111.152.83:34287] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "aeskXuhlUs6BS3Ng7_UYXwAAANU"]
[Fri Apr 24 16:05:50.937925 2026] [:error] [pid 17721:tid 17805] [client 155.2.215.107:21605] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aeskXuFXXkLeyDnfk__zoAAAABg"]
[Fri Apr 24 16:05:51.685681 2026] [:error] [pid 17720:tid 17770] [client 155.2.215.105:41009] [client 155.2.215.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aeskX-hlUs6BS3Ng7_UYYwAAANA"]
[Fri Apr 24 16:05:53.710760 2026] [:error] [pid 17720:tid 17764] [client 142.111.152.185:35481] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aeskYehlUs6BS3Ng7_UYcQAAAMo"]
[Fri Apr 24 16:05:54.497113 2026] [:error] [pid 22114:tid 22138] [client 142.111.152.86:48863] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aeskYoAuWGz3WlMQjoe6HAAAARU"]
[Fri Apr 24 16:05:57.093748 2026] [:error] [pid 14531:tid 14548] [client 142.111.152.185:21867] [client 142.111.152.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.185, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/js/wp-login.php"] [unique_id "aeskZXfLU2gw-6KR-GZvVgAAAU8"]
[Fri Apr 24 16:05:58.774091 2026] [:error] [pid 14531:tid 14535] [client 142.111.152.185:21867] [client 142.111.152.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.185, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aeskZnfLU2gw-6KR-GZvXAAAAUI"]
[Fri Apr 24 16:06:01.780767 2026] [proxy_fcgi:error] [pid 14531:tid 14537] [client 142.111.152.185:21867] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:07.032106 2026] [:error] [pid 14531:tid 14552] [client 142.111.152.185:21867] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aeskb3fLU2gw-6KR-GZvfwAAAVM"]
[Fri Apr 24 16:06:08.307223 2026] [:error] [pid 17720:tid 17773] [client 155.2.215.102:48665] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aeskcOhlUs6BS3Ng7_UYnQAAANM"]
[Fri Apr 24 16:06:09.308911 2026] [:error] [pid 17720:tid 17762] [client 155.2.215.98:35157] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aeskcehlUs6BS3Ng7_UYogAAAMg"]
[Fri Apr 24 16:06:13.493836 2026] [:error] [pid 17808:tid 17831] [client 142.111.152.202:55967] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aeskdearbOEFI8qshvLHsQAAAFU"]
[Fri Apr 24 16:06:14.469394 2026] [:error] [pid 17720:tid 17767] [client 142.111.152.191:36083] [client 142.111.152.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aeskduhlUs6BS3Ng7_UYrgAAAM0"]
[Fri Apr 24 16:06:15.219657 2026] [:error] [pid 17720:tid 17778] [client 142.111.152.196:42043] [client 142.111.152.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aeskd-hlUs6BS3Ng7_UYsgAAANg"]
[Fri Apr 24 16:06:16.748609 2026] [proxy_fcgi:error] [pid 17808:tid 17810] [client 155.2.215.100:38139] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:17.013535 2026] [proxy_fcgi:error] [pid 17808:tid 17824] [client 155.2.215.100:38139] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:17.356443 2026] [:error] [pid 17808:tid 17823] [client 155.2.215.100:38139] [client 155.2.215.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aeskeearbOEFI8qshvLHxAAAAE0"]
[Fri Apr 24 16:06:17.880221 2026] [:error] [pid 17808:tid 17816] [client 142.111.152.197:36521] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aeskeearbOEFI8qshvLHyQAAAEY"]
[Fri Apr 24 16:06:21.811014 2026] [:error] [pid 17721:tid 17784] [client 142.111.152.196:31257] [client 142.111.152.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aeskfeFXXkLeyDnfk__zvwAAAAM"]
[Fri Apr 24 16:06:22.539642 2026] [:error] [pid 22114:tid 22121] [client 142.111.152.188:25893] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "aeskfoAuWGz3WlMQjoe6NQAAAQQ"]
[Fri Apr 24 16:06:23.826804 2026] [:error] [pid 17720:tid 17772] [client 155.2.215.107:62947] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aeskf-hlUs6BS3Ng7_UYwgAAANI"]
[Fri Apr 24 16:06:26.338365 2026] [:error] [pid 17720:tid 17761] [client 155.2.215.115:42581] [client 155.2.215.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aeskguhlUs6BS3Ng7_UYzgAAAMc"]
[Fri Apr 24 16:06:26.875604 2026] [proxy_fcgi:error] [pid 17808:tid 17814] [client 142.111.152.195:49907] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:27.638699 2026] [:error] [pid 17808:tid 17824] [client 142.111.152.195:49907] [client 142.111.152.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aeskg-arbOEFI8qshvLH5QAAAE4"]
[Fri Apr 24 16:06:29.424312 2026] [proxy_fcgi:error] [pid 14531:tid 14545] [client 142.111.152.82:29257] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:29.918363 2026] [:error] [pid 14531:tid 14547] [client 142.111.152.82:29257] [client 142.111.152.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.82, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aeskhXfLU2gw-6KR-GZvoQAAAU4"]
[Fri Apr 24 16:06:31.362312 2026] [:error] [pid 14531:tid 14550] [client 142.111.152.82:29257] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aeskh3fLU2gw-6KR-GZvqwAAAVE"]
[Fri Apr 24 16:06:32.112118 2026] [:error] [pid 17808:tid 17824] [client 142.111.152.77:22471] [client 142.111.152.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aeskiOarbOEFI8qshvLH9gAAAE4"]
[Fri Apr 24 16:06:33.644659 2026] [:error] [pid 14531:tid 14552] [client 142.111.152.202:36817] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aeskiXfLU2gw-6KR-GZv8gAAAVM"]
[Fri Apr 24 16:06:34.983805 2026] [:error] [pid 17720:tid 17777] [client 142.111.152.189:62959] [client 142.111.152.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aeskiuhlUs6BS3Ng7_UY6gAAANc"]
[Fri Apr 24 16:06:36.566733 2026] [:error] [pid 22114:tid 22117] [client 142.111.152.81:28953] [client 142.111.152.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aeskjIAuWGz3WlMQjoe6PwAAAQA"]
[Fri Apr 24 16:06:37.919586 2026] [:error] [pid 22114:tid 22119] [client 155.2.215.111:30701] [client 155.2.215.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aeskjYAuWGz3WlMQjoe6SwAAAQI"]
[Fri Apr 24 16:06:39.111819 2026] [proxy_fcgi:error] [pid 17720:tid 17760] [client 155.2.215.98:35945] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:39.400794 2026] [:error] [pid 17720:tid 17755] [client 155.2.215.98:35945] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aeskj-hlUs6BS3Ng7_UY-QAAAME"]
[Fri Apr 24 16:06:40.168820 2026] [:error] [pid 17720:tid 17772] [client 142.111.152.82:39287] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/db.php"] [unique_id "aeskkOhlUs6BS3Ng7_UY_gAAANI"]
[Fri Apr 24 16:06:40.708336 2026] [:error] [pid 17720:tid 17756] [client 142.111.152.74:27273] [client 142.111.152.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aeskkOhlUs6BS3Ng7_UZAQAAAMI"]
[Fri Apr 24 16:06:41.221096 2026] [:error] [pid 17721:tid 17781] [client 142.111.152.82:55883] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aeskkeFXXkLeyDnfk__zzAAAAAA"]
[Fri Apr 24 16:06:41.726281 2026] [:error] [pid 17808:tid 17817] [client 142.111.152.79:45279] [client 142.111.152.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aeskkearbOEFI8qshvLINQAAAEc"]
[Fri Apr 24 16:06:42.226957 2026] [:error] [pid 17720:tid 17777] [client 155.2.215.96:56813] [client 155.2.215.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aeskkuhlUs6BS3Ng7_UZCAAAANc"]
[Fri Apr 24 16:06:42.729075 2026] [:error] [pid 17808:tid 17825] [client 155.2.215.100:37431] [client 155.2.215.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aeskkuarbOEFI8qshvLIOwAAAE8"]
[Fri Apr 24 16:06:43.787275 2026] [:error] [pid 17720:tid 17764] [client 155.2.215.98:63753] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aeskk-hlUs6BS3Ng7_UZFQAAAMo"]
[Fri Apr 24 16:06:44.278897 2026] [:error] [pid 17720:tid 17755] [client 155.2.215.108:64949] [client 155.2.215.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aesklOhlUs6BS3Ng7_UZGgAAAME"]
[Fri Apr 24 16:06:44.839826 2026] [:error] [pid 17720:tid 17758] [client 155.2.215.115:24371] [client 155.2.215.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aesklOhlUs6BS3Ng7_UZIgAAAMQ"]
[Fri Apr 24 16:06:45.396036 2026] [:error] [pid 17720:tid 17755] [client 142.111.152.189:34255] [client 142.111.152.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aesklehlUs6BS3Ng7_UZJQAAAME"]
[Fri Apr 24 16:06:45.925922 2026] [:error] [pid 17720:tid 17771] [client 142.111.152.83:47515] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aesklehlUs6BS3Ng7_UZLQAAANE"]
[Fri Apr 24 16:06:46.888039 2026] [proxy_fcgi:error] [pid 22114:tid 22127] [client 155.2.215.113:56087] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:06:47.628791 2026] [:error] [pid 22114:tid 22134] [client 155.2.215.113:56087] [client 155.2.215.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.2.215.113, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aeskl4AuWGz3WlMQjoe6VAAAARE"]
[Fri Apr 24 16:06:48.961776 2026] [:error] [pid 22114:tid 22129] [client 155.2.215.113:56087] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aeskmIAuWGz3WlMQjoe6WQAAAQw"]
[Fri Apr 24 16:06:54.315812 2026] [:error] [pid 17808:tid 17830] [client 142.111.152.197:48319] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aesknuarbOEFI8qshvLIZgAAAFQ"]
[Fri Apr 24 16:06:54.841505 2026] [:error] [pid 17719:tid 17733] [client 155.2.215.112:24003] [client 155.2.215.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aesknsTZ9gzEyL1BkPptwgAAAIY"]
[Fri Apr 24 16:06:55.358289 2026] [:error] [pid 17721:tid 17791] [client 142.111.152.194:36797] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aeskn-FXXkLeyDnfk__z3AAAAAo"]
[Fri Apr 24 16:06:57.554619 2026] [:error] [pid 17720:tid 17764] [client 142.111.152.78:47707] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aeskoehlUs6BS3Ng7_UZaQAAAMo"]
[Fri Apr 24 16:06:58.051126 2026] [:error] [pid 14531:tid 14553] [client 142.111.152.187:52377] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aeskonfLU2gw-6KR-GZwnAAAAVQ"]
[Fri Apr 24 16:06:58.553210 2026] [:error] [pid 17720:tid 17771] [client 142.111.152.191:28109] [client 142.111.152.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aeskouhlUs6BS3Ng7_UZcwAAANE"]
[Fri Apr 24 16:07:00.482328 2026] [:error] [pid 17720:tid 17771] [client 142.111.152.192:23175] [client 142.111.152.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aeskpOhlUs6BS3Ng7_UZfAAAANE"]
[Fri Apr 24 16:07:01.206380 2026] [:error] [pid 17720:tid 17761] [client 142.111.152.84:57851] [client 142.111.152.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aeskpehlUs6BS3Ng7_UZgwAAAMc"]
[Fri Apr 24 16:07:02.207349 2026] [:error] [pid 22114:tid 22136] [client 142.111.152.187:25805] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aeskpoAuWGz3WlMQjoe6YgAAARM"]
[Fri Apr 24 16:07:05.613612 2026] [:error] [pid 17808:tid 17833] [client 155.2.215.108:38777] [client 155.2.215.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aeskqearbOEFI8qshvLIhwAAAFc"]
[Fri Apr 24 16:07:06.441194 2026] [:error] [pid 17721:tid 17790] [client 142.111.152.185:38781] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "aeskquFXXkLeyDnfk__z7AAAAAk"]
[Fri Apr 24 16:07:08.538879 2026] [:error] [pid 17721:tid 17795] [client 155.2.215.102:55103] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aeskrOFXXkLeyDnfk__z9QAAAA4"]
[Fri Apr 24 16:07:09.599401 2026] [:error] [pid 17808:tid 17819] [client 155.2.215.111:24903] [client 155.2.215.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aeskrearbOEFI8qshvLIkQAAAEk"]
[Fri Apr 24 16:07:11.258282 2026] [:error] [pid 17808:tid 17816] [client 142.111.152.188:36987] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aeskr-arbOEFI8qshvLInQAAAEY"]
[Fri Apr 24 16:07:12.946020 2026] [:error] [pid 14531:tid 14544] [client 142.111.152.238:64031] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aesksHfLU2gw-6KR-GZwrwAAAUs"]
[Fri Apr 24 16:07:13.992825 2026] [:error] [pid 17808:tid 17827] [client 155.2.215.110:48361] [client 155.2.215.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aesksearbOEFI8qshvLIpAAAAFE"]
[Fri Apr 24 16:07:15.617753 2026] [:error] [pid 17808:tid 17828] [client 142.111.152.82:47125] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aesks-arbOEFI8qshvLIrAAAAFI"]
[Fri Apr 24 16:07:17.693355 2026] [:error] [pid 17719:tid 17750] [client 155.2.215.109:47747] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aesktcTZ9gzEyL1BkPpt4AAAAJc"]
[Fri Apr 24 16:07:19.526477 2026] [:error] [pid 17721:tid 17794] [client 155.2.215.108:26803] [client 155.2.215.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aeskt-FXXkLeyDnfk__0AwAAAA0"]
[Fri Apr 24 16:07:21.222304 2026] [:error] [pid 17808:tid 17821] [client 142.111.152.83:39789] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeskuearbOEFI8qshvLIzwAAAEs"]
[Fri Apr 24 16:07:21.714356 2026] [:error] [pid 17719:tid 17741] [client 155.2.215.115:39579] [client 155.2.215.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aeskucTZ9gzEyL1BkPpt5AAAAI4"]
[Fri Apr 24 16:07:22.491632 2026] [:error] [pid 14531:tid 14549] [client 142.111.152.238:48805] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aeskunfLU2gw-6KR-GZwxwAAAVA"]
[Fri Apr 24 16:07:23.568655 2026] [:error] [pid 17720:tid 17762] [client 142.111.152.81:52071] [client 142.111.152.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/install.php"] [unique_id "aesku-hlUs6BS3Ng7_UZpQAAAMg"]
[Fri Apr 24 16:07:24.068381 2026] [:error] [pid 17720:tid 17776] [client 155.2.215.96:50261] [client 155.2.215.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aeskvOhlUs6BS3Ng7_UZpwAAANY"]
[Fri Apr 24 16:07:26.583233 2026] [:error] [pid 22114:tid 22124] [client 142.111.152.81:41879] [client 142.111.152.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/category-double.php"] [unique_id "aeskvoAuWGz3WlMQjoe6dwAAAQc"]
[Fri Apr 24 16:07:27.558831 2026] [:error] [pid 17721:tid 17800] [client 155.2.215.107:57573] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aeskv-FXXkLeyDnfk__0CAAAABM"]
[Fri Apr 24 16:07:28.089366 2026] [:error] [pid 17808:tid 17826] [client 142.111.152.78:23655] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aeskwOarbOEFI8qshvLI3wAAAFA"]
[Fri Apr 24 16:07:29.260047 2026] [:error] [pid 17720:tid 17764] [client 142.111.152.187:24653] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aeskwehlUs6BS3Ng7_UZvAAAAMo"]
[Fri Apr 24 16:07:30.033987 2026] [:error] [pid 17720:tid 17772] [client 142.111.152.83:26857] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aeskwuhlUs6BS3Ng7_UZxwAAANI"]
[Fri Apr 24 16:07:31.840855 2026] [:error] [pid 14531:tid 14556] [client 142.111.152.78:61521] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aeskw3fLU2gw-6KR-GZw5QAAAVc"]
[Fri Apr 24 16:07:33.060828 2026] [:error] [pid 17720:tid 17775] [client 155.2.215.103:54161] [client 155.2.215.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aeskxehlUs6BS3Ng7_UZ2QAAANU"]
[Fri Apr 24 16:07:34.394497 2026] [:error] [pid 22114:tid 22129] [client 142.111.152.80:23385] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aeskxoAuWGz3WlMQjoe6igAAAQw"]
[Fri Apr 24 16:07:35.407211 2026] [:error] [pid 17808:tid 17821] [client 142.111.152.82:36369] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/as.php"] [unique_id "aeskx-arbOEFI8qshvLI8AAAAEs"]
[Fri Apr 24 16:07:36.148451 2026] [:error] [pid 17721:tid 17801] [client 155.2.215.97:45597] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aeskyOFXXkLeyDnfk__0GgAAABQ"]
[Fri Apr 24 16:07:36.651406 2026] [:error] [pid 17808:tid 17812] [client 155.2.215.113:40743] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/install.php"] [unique_id "aeskyOarbOEFI8qshvLI9wAAAEI"]
[Fri Apr 24 16:07:37.170100 2026] [:error] [pid 17808:tid 17818] [client 142.111.152.202:29729] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aeskyearbOEFI8qshvLI_AAAAEg"]
[Fri Apr 24 16:07:39.328524 2026] [:error] [pid 17719:tid 17737] [client 142.111.152.186:64459] [client 142.111.152.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aesky8TZ9gzEyL1BkPpt_gAAAIo"]
[Fri Apr 24 16:07:40.644012 2026] [:error] [pid 17808:tid 17822] [client 142.111.152.87:63615] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rk2.php"] [unique_id "aeskzOarbOEFI8qshvLJCQAAAEw"]
[Fri Apr 24 16:07:41.689682 2026] [:error] [pid 17719:tid 17746] [client 155.2.215.97:42979] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aeskzcTZ9gzEyL1BkPpuBQAAAJM"]
[Fri Apr 24 16:07:42.722285 2026] [:error] [pid 17808:tid 17832] [client 155.2.215.111:49299] [client 155.2.215.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aeskzuarbOEFI8qshvLJFQAAAFY"]
[Fri Apr 24 16:07:44.556879 2026] [:error] [pid 17808:tid 17829] [client 142.111.152.82:29107] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aesk0OarbOEFI8qshvLJHgAAAFM"]
[Fri Apr 24 16:07:45.381889 2026] [:error] [pid 14531:tid 14555] [client 142.111.152.77:35327] [client 142.111.152.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aesk0XfLU2gw-6KR-GZxBQAAAVY"]
[Fri Apr 24 16:07:46.180380 2026] [:error] [pid 14531:tid 14540] [client 155.2.215.101:51117] [client 155.2.215.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aesk0nfLU2gw-6KR-GZxCwAAAUc"]
[Fri Apr 24 16:07:47.307710 2026] [:error] [pid 14531:tid 14545] [client 142.111.152.83:37639] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aesk03fLU2gw-6KR-GZxDwAAAUw"]
[Fri Apr 24 16:07:50.053329 2026] [:error] [pid 17720:tid 17769] [client 155.2.215.104:22315] [client 155.2.215.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aesk1uhlUs6BS3Ng7_UZ-wAAAM8"]
[Fri Apr 24 16:07:50.580428 2026] [:error] [pid 17721:tid 17792] [client 142.111.152.78:40275] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aesk1uFXXkLeyDnfk__0JAAAAAs"]
[Fri Apr 24 16:07:51.898925 2026] [:error] [pid 17808:tid 17819] [client 155.2.215.98:40255] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aesk1-arbOEFI8qshvLJJAAAAEk"]
[Fri Apr 24 16:07:52.427877 2026] [:error] [pid 17720:tid 17768] [client 142.111.152.80:49081] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aesk2OhlUs6BS3Ng7_UaAgAAAM4"]
[Fri Apr 24 16:07:53.426098 2026] [:error] [pid 14531:tid 14536] [client 155.2.215.96:28573] [client 155.2.215.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aesk2XfLU2gw-6KR-GZxGQAAAUM"]
[Fri Apr 24 16:07:53.932662 2026] [:error] [pid 22114:tid 22125] [client 142.111.152.192:34387] [client 142.111.152.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aesk2YAuWGz3WlMQjoe6tAAAAQg"]
[Fri Apr 24 16:07:54.453721 2026] [:error] [pid 22114:tid 22118] [client 142.111.152.189:58231] [client 142.111.152.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.189, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aesk2oAuWGz3WlMQjoe6uAAAAQE"]
[Fri Apr 24 16:07:54.464293 2026] [proxy_fcgi:error] [pid 22114:tid 22118] [client 142.111.152.189:58231] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:07:54.701161 2026] [:error] [pid 22114:tid 22132] [client 142.111.152.189:58231] [client 142.111.152.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aesk2oAuWGz3WlMQjoe6uQAAAQ8"]
[Fri Apr 24 16:07:55.739438 2026] [:error] [pid 17808:tid 17811] [client 142.111.152.83:30001] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aesk2-arbOEFI8qshvLJLgAAAEE"]
[Fri Apr 24 16:07:56.244216 2026] [:error] [pid 17719:tid 17745] [client 142.111.152.187:34715] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/network.php"] [unique_id "aesk3MTZ9gzEyL1BkPpuIwAAAJI"]
[Fri Apr 24 16:08:01.719635 2026] [:error] [pid 17808:tid 17818] [client 142.111.152.238:57757] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aesk4earbOEFI8qshvLJTQAAAEg"]
[Fri Apr 24 16:08:02.233341 2026] [:error] [pid 17721:tid 17785] [client 142.111.152.187:31639] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aesk4uFXXkLeyDnfk__0OwAAAAQ"]
[Fri Apr 24 16:08:03.253629 2026] [:error] [pid 17719:tid 17734] [client 142.111.152.187:54665] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aesk48TZ9gzEyL1BkPpuNgAAAIc"]
[Fri Apr 24 16:08:03.778481 2026] [:error] [pid 22114:tid 22122] [client 142.111.152.86:57817] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aesk44AuWGz3WlMQjoe61QAAAQU"]
[Fri Apr 24 16:08:04.270354 2026] [proxy_fcgi:error] [pid 14531:tid 14554] [client 142.111.152.79:63083] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:08:04.937778 2026] [:error] [pid 14531:tid 14552] [client 142.111.152.79:63083] [client 142.111.152.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.79, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aesk5HfLU2gw-6KR-GZxHgAAAVM"]
[Fri Apr 24 16:08:05.423636 2026] [:error] [pid 14531:tid 14534] [client 142.111.152.79:63083] [client 142.111.152.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aesk5XfLU2gw-6KR-GZxIAAAAUE"]
[Fri Apr 24 16:08:06.699901 2026] [:error] [pid 17808:tid 17818] [client 142.111.152.76:37915] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aesk5uarbOEFI8qshvLJVQAAAEg"]
[Fri Apr 24 16:08:07.566353 2026] [:error] [pid 14531:tid 14551] [client 155.2.215.110:28291] [client 155.2.215.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aesk53fLU2gw-6KR-GZxJAAAAVI"]
[Fri Apr 24 16:08:08.097357 2026] [:error] [pid 17808:tid 17834] [client 142.111.152.81:40233] [client 142.111.152.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aesk6OarbOEFI8qshvLJVwAAAFg"]
[Fri Apr 24 16:08:09.582710 2026] [:error] [pid 17808:tid 17829] [client 142.111.152.197:48929] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aesk6earbOEFI8qshvLJXAAAAFM"]
[Fri Apr 24 16:08:10.602111 2026] [:error] [pid 17720:tid 17772] [client 142.111.152.83:38257] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aesk6uhlUs6BS3Ng7_UaKwAAANI"]
[Fri Apr 24 16:08:12.079289 2026] [:error] [pid 17719:tid 17732] [client 142.111.152.238:64041] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aesk7MTZ9gzEyL1BkPpuQQAAAIU"]
[Fri Apr 24 16:08:12.562428 2026] [:error] [pid 17721:tid 17791] [client 142.111.152.87:50417] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bypass.php"] [unique_id "aesk7OFXXkLeyDnfk__0SgAAAAo"]
[Fri Apr 24 16:08:13.400857 2026] [:error] [pid 17721:tid 17805] [client 142.111.152.87:49653] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/count.php"] [unique_id "aesk7eFXXkLeyDnfk__0UwAAABg"]
[Fri Apr 24 16:08:15.461739 2026] [:error] [pid 17721:tid 17795] [client 155.2.215.98:60223] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aesk7-FXXkLeyDnfk__0YgAAAA4"]
[Fri Apr 24 16:08:16.496899 2026] [:error] [pid 14531:tid 14549] [client 142.111.152.86:35553] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com"] [uri "/images/stories/themes.php"] [unique_id "aesk8HfLU2gw-6KR-GZxLgAAAVA"]
[Fri Apr 24 16:08:16.747147 2026] [:error] [pid 14531:tid 14536] [client 142.111.152.86:35553] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aesk8HfLU2gw-6KR-GZxLwAAAUM"]
[Fri Apr 24 16:08:17.786383 2026] [:error] [pid 17721:tid 17796] [client 155.2.215.101:45271] [client 155.2.215.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aesk8eFXXkLeyDnfk__0ZgAAAA8"]
[Fri Apr 24 16:08:18.367380 2026] [:error] [pid 17808:tid 17827] [client 155.2.215.113:58319] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aesk8uarbOEFI8qshvLJXgAAAFE"]
[Fri Apr 24 16:08:20.496718 2026] [:error] [pid 17720:tid 17754] [client 155.2.215.97:59999] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aesk9OhlUs6BS3Ng7_UaQAAAAMA"]
[Fri Apr 24 16:08:21.551324 2026] [:error] [pid 17719:tid 17751] [client 142.111.152.82:47697] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aesk9cTZ9gzEyL1BkPpuRwAAAJg"]
[Fri Apr 24 16:08:22.363330 2026] [:error] [pid 22114:tid 22138] [client 142.111.152.198:39161] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aesk9oAuWGz3WlMQjoe64AAAARU"]
[Fri Apr 24 16:08:24.564892 2026] [:error] [pid 14531:tid 14542] [client 142.111.152.76:27341] [client 142.111.152.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aesk-HfLU2gw-6KR-GZxRAAAAUk"]
[Fri Apr 24 16:08:25.059434 2026] [:error] [pid 14531:tid 14545] [client 142.111.152.80:21829] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/colour.php"] [unique_id "aesk-XfLU2gw-6KR-GZxRQAAAUw"]
[Fri Apr 24 16:08:25.828309 2026] [:error] [pid 17720:tid 17767] [client 142.111.152.197:42423] [client 142.111.152.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aesk-ehlUs6BS3Ng7_UaSAAAAM0"]
[Fri Apr 24 16:08:26.356088 2026] [:error] [pid 17721:tid 17800] [client 155.2.215.104:30753] [client 155.2.215.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/include.php"] [unique_id "aesk-uFXXkLeyDnfk__0bQAAABM"]
[Fri Apr 24 16:08:27.645886 2026] [:error] [pid 14531:tid 14557] [client 142.111.152.74:29267] [client 142.111.152.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aesk-3fLU2gw-6KR-GZxSQAAAVg"]
[Fri Apr 24 16:08:28.761628 2026] [:error] [pid 17721:tid 17796] [client 155.2.215.109:33859] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aesk_OFXXkLeyDnfk__0dAAAAA8"]
[Fri Apr 24 16:08:29.245528 2026] [:error] [pid 17720:tid 17762] [client 142.111.152.187:22725] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aesk_ehlUs6BS3Ng7_UaTgAAAMg"]
[Fri Apr 24 16:08:30.945385 2026] [:error] [pid 17721:tid 17804] [client 155.2.215.109:51949] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aesk_uFXXkLeyDnfk__0fgAAABc"]
[Fri Apr 24 16:08:31.933515 2026] [:error] [pid 17719:tid 17746] [client 155.2.215.109:28609] [client 155.2.215.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aesk_8TZ9gzEyL1BkPpuWAAAAJM"]
[Fri Apr 24 16:08:33.196290 2026] [:error] [pid 17721:tid 17781] [client 142.111.152.238:64449] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aeslAeFXXkLeyDnfk__0hAAAAAA"]
[Fri Apr 24 16:08:33.724695 2026] [:error] [pid 17808:tid 17830] [client 142.111.152.79:46591] [client 142.111.152.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aeslAearbOEFI8qshvLJfQAAAFQ"]
[Fri Apr 24 16:08:34.211569 2026] [:error] [pid 14531:tid 14548] [client 155.2.215.115:21833] [client 155.2.215.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aeslAnfLU2gw-6KR-GZxVwAAAU8"]
[Fri Apr 24 16:08:35.236752 2026] [:error] [pid 22114:tid 22122] [client 142.111.152.194:47327] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aeslA4AuWGz3WlMQjoe65gAAAQU"]
[Fri Apr 24 16:08:36.266770 2026] [:error] [pid 17720:tid 17770] [client 142.111.152.189:31271] [client 142.111.152.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aeslBOhlUs6BS3Ng7_UaVwAAANA"]
[Fri Apr 24 16:08:37.767508 2026] [:error] [pid 17808:tid 17811] [client 155.2.215.105:44489] [client 155.2.215.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aeslBearbOEFI8qshvLJhwAAAEE"]
[Fri Apr 24 16:08:38.501672 2026] [:error] [pid 14531:tid 14536] [client 155.2.215.112:30177] [client 155.2.215.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aeslBnfLU2gw-6KR-GZxZgAAAUM"]
[Fri Apr 24 16:08:39.052588 2026] [:error] [pid 14531:tid 14546] [client 142.111.152.83:50413] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aeslB3fLU2gw-6KR-GZxaQAAAU0"]
[Fri Apr 24 16:08:40.096081 2026] [:error] [pid 14531:tid 14542] [client 142.111.152.83:51035] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aeslCHfLU2gw-6KR-GZxcgAAAUk"]
[Fri Apr 24 16:08:40.917770 2026] [:error] [pid 17808:tid 17826] [client 142.111.152.200:47331] [client 142.111.152.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aeslCOarbOEFI8qshvLJjgAAAFA"]
[Fri Apr 24 16:08:41.401772 2026] [:error] [pid 17720:tid 17763] [client 155.2.215.101:42347] [client 155.2.215.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aeslCehlUs6BS3Ng7_UaXwAAAMk"]
[Fri Apr 24 16:08:41.882188 2026] [:error] [pid 17720:tid 17773] [client 142.111.152.80:59983] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aeslCehlUs6BS3Ng7_UaYAAAANM"]
[Fri Apr 24 16:08:43.043372 2026] [:error] [pid 17720:tid 17765] [client 142.111.152.84:20093] [client 142.111.152.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aeslC-hlUs6BS3Ng7_UaawAAAMs"]
[Fri Apr 24 16:08:44.090139 2026] [:error] [pid 17721:tid 17782] [client 155.2.215.100:60993] [client 155.2.215.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aeslDOFXXkLeyDnfk__0jQAAAAE"]
[Fri Apr 24 16:08:44.848836 2026] [:error] [pid 17720:tid 17754] [client 155.2.215.100:40775] [client 155.2.215.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aeslDOhlUs6BS3Ng7_UadQAAAMA"]
[Fri Apr 24 16:08:45.640787 2026] [:error] [pid 17720:tid 17767] [client 142.111.152.87:32029] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aeslDehlUs6BS3Ng7_UaewAAAM0"]
[Fri Apr 24 16:08:47.637912 2026] [:error] [pid 22114:tid 22118] [client 155.2.215.110:43863] [client 155.2.215.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugin.php"] [unique_id "aeslD4AuWGz3WlMQjoe69AAAAQE"]
[Fri Apr 24 16:08:48.126738 2026] [:error] [pid 17720:tid 17768] [client 155.2.215.101:30377] [client 155.2.215.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aeslEOhlUs6BS3Ng7_UahAAAAM4"]
[Fri Apr 24 16:08:49.206576 2026] [:error] [pid 17720:tid 17763] [client 142.111.152.198:34863] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aeslEehlUs6BS3Ng7_UaiQAAAMk"]
[Fri Apr 24 16:08:50.719048 2026] [:error] [pid 17720:tid 17770] [client 155.2.215.102:57845] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aeslEuhlUs6BS3Ng7_UalQAAANA"]
[Fri Apr 24 16:08:51.758301 2026] [:error] [pid 17719:tid 17750] [client 142.111.152.79:31731] [client 142.111.152.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aeslE8TZ9gzEyL1BkPpuYgAAAJc"]
[Fri Apr 24 16:08:52.774141 2026] [:error] [pid 17808:tid 17824] [client 142.111.152.83:47323] [client 142.111.152.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aeslFOarbOEFI8qshvLJswAAAE4"]
[Fri Apr 24 16:08:53.584678 2026] [:error] [pid 17719:tid 17749] [client 155.2.215.106:55665] [client 155.2.215.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aeslFcTZ9gzEyL1BkPpuZAAAAJY"]
[Fri Apr 24 16:08:54.378531 2026] [:error] [pid 17808:tid 17812] [client 155.2.215.107:46429] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aeslFuarbOEFI8qshvLJtQAAAEI"]
[Fri Apr 24 16:08:55.952522 2026] [:error] [pid 14531:tid 14554] [client 142.111.152.84:27767] [client 142.111.152.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aeslF3fLU2gw-6KR-GZxhwAAAVU"]
[Fri Apr 24 16:08:57.203115 2026] [:error] [pid 17719:tid 17751] [client 155.2.215.102:20315] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aeslGcTZ9gzEyL1BkPpuagAAAJg"]
[Fri Apr 24 16:08:57.710971 2026] [proxy_fcgi:error] [pid 17808:tid 17823] [client 155.2.215.103:32921] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 16:08:57.971112 2026] [:error] [pid 17808:tid 17824] [client 155.2.215.103:32921] [client 155.2.215.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aeslGearbOEFI8qshvLJugAAAE4"]
[Fri Apr 24 16:08:58.502158 2026] [:error] [pid 17720:tid 17774] [client 142.111.152.188:34823] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aeslGuhlUs6BS3Ng7_UapwAAANQ"]
[Fri Apr 24 16:08:59.540399 2026] [:error] [pid 17720:tid 17775] [client 142.111.152.203:48789] [client 142.111.152.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aeslG-hlUs6BS3Ng7_UarAAAANU"]
[Fri Apr 24 16:09:00.056218 2026] [:error] [pid 17808:tid 17812] [client 142.111.152.189:29701] [client 142.111.152.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aeslHOarbOEFI8qshvLJwAAAAEI"]
[Fri Apr 24 16:09:02.195945 2026] [:error] [pid 14531:tid 14537] [client 142.111.152.80:34791] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aeslHnfLU2gw-6KR-GZxqwAAAUQ"]
[Fri Apr 24 16:09:02.677922 2026] [:error] [pid 17721:tid 17782] [client 142.111.152.186:59473] [client 142.111.152.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aeslHuFXXkLeyDnfk__0kwAAAAE"]
[Fri Apr 24 16:09:03.417483 2026] [:error] [pid 17720:tid 17756] [client 142.111.152.82:37231] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/log.php"] [unique_id "aeslH-hlUs6BS3Ng7_UaxQAAAMI"]
[Fri Apr 24 16:09:03.947668 2026] [:error] [pid 17808:tid 17817] [client 155.2.215.97:36045] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aeslH-arbOEFI8qshvLJxQAAAEc"]
[Fri Apr 24 16:09:04.441966 2026] [:error] [pid 17720:tid 17777] [client 142.111.152.187:22485] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aeslIOhlUs6BS3Ng7_UazQAAANc"]
[Fri Apr 24 16:09:04.942818 2026] [:error] [pid 17720:tid 17768] [client 142.111.152.203:20387] [client 142.111.152.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/aw.php"] [unique_id "aeslIOhlUs6BS3Ng7_UazwAAAM4"]
[Fri Apr 24 16:09:06.647182 2026] [:error] [pid 17720:tid 17764] [client 155.2.215.102:47915] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aeslIuhlUs6BS3Ng7_Ua3AAAAMo"]
[Fri Apr 24 16:09:07.128405 2026] [:error] [pid 17808:tid 17829] [client 142.111.152.187:56563] [client 142.111.152.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/install.php"] [unique_id "aeslI-arbOEFI8qshvLJygAAAFM"]
[Fri Apr 24 16:09:08.177627 2026] [:error] [pid 17720:tid 17772] [client 142.111.152.202:40857] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aeslJOhlUs6BS3Ng7_Ua5QAAANI"]
[Fri Apr 24 16:09:08.695337 2026] [:error] [pid 17719:tid 17727] [client 155.2.215.97:34033] [client 155.2.215.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aeslJMTZ9gzEyL1BkPpupAAAAIA"]
[Fri Apr 24 16:09:09.729407 2026] [:error] [pid 17720:tid 17775] [client 155.2.215.107:40149] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/template-less.php"] [unique_id "aeslJehlUs6BS3Ng7_Ua7AAAANU"]
[Fri Apr 24 16:09:10.218034 2026] [:error] [pid 17720:tid 17768] [client 142.111.152.203:51443] [client 142.111.152.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aeslJuhlUs6BS3Ng7_Ua7QAAAM4"]
[Fri Apr 24 16:09:12.558435 2026] [:error] [pid 17720:tid 17765] [client 142.111.152.188:46293] [client 142.111.152.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aeslKOhlUs6BS3Ng7_Ua_QAAAMs"]
[Fri Apr 24 16:09:13.086809 2026] [:error] [pid 14531:tid 14536] [client 142.111.152.80:60303] [client 142.111.152.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aeslKXfLU2gw-6KR-GZx8QAAAUM"]
[Fri Apr 24 16:09:14.159989 2026] [:error] [pid 14531:tid 14540] [client 142.111.152.194:47539] [client 142.111.152.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/file.php"] [unique_id "aeslKnfLU2gw-6KR-GZx9wAAAUc"]
[Fri Apr 24 16:09:14.974928 2026] [:error] [pid 14531:tid 14535] [client 142.111.152.85:36641] [client 142.111.152.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aeslKnfLU2gw-6KR-GZx_QAAAUI"]
[Fri Apr 24 16:09:15.727273 2026] [:error] [pid 14531:tid 14545] [client 142.111.152.198:39759] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/load.php"] [unique_id "aeslK3fLU2gw-6KR-GZyAQAAAUw"]
[Fri Apr 24 16:09:16.295821 2026] [:error] [pid 17720:tid 17761] [client 142.111.152.88:61733] [client 142.111.152.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aeslLOhlUs6BS3Ng7_UbAQAAAMc"]
[Fri Apr 24 16:09:16.795710 2026] [:error] [pid 17719:tid 17751] [client 155.2.215.110:39729] [client 155.2.215.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aeslLMTZ9gzEyL1BkPpusgAAAJg"]
[Fri Apr 24 16:09:18.062472 2026] [:error] [pid 17719:tid 17741] [client 142.111.152.200:57957] [client 142.111.152.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aeslLsTZ9gzEyL1BkPpuuwAAAI4"]
[Fri Apr 24 16:09:18.808371 2026] [:error] [pid 14531:tid 14533] [client 142.111.152.78:32305] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aeslLnfLU2gw-6KR-GZyBAAAAUA"]
[Fri Apr 24 16:09:19.888504 2026] [:error] [pid 14531:tid 14534] [client 155.2.215.110:37989] [client 155.2.215.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aeslL3fLU2gw-6KR-GZyCwAAAUE"]
[Fri Apr 24 16:09:20.362722 2026] [:error] [pid 17808:tid 17832] [client 155.2.215.98:63335] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aeslMOarbOEFI8qshvLJ2gAAAFY"]
[Fri Apr 24 16:09:20.869228 2026] [:error] [pid 17808:tid 17834] [client 142.111.152.85:38739] [client 142.111.152.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aeslMOarbOEFI8qshvLJ2wAAAFg"]
[Fri Apr 24 16:09:23.425045 2026] [:error] [pid 17808:tid 17829] [client 142.111.152.198:47153] [client 142.111.152.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aeslM-arbOEFI8qshvLJ8AAAAFM"]
[Fri Apr 24 16:09:24.162766 2026] [:error] [pid 17808:tid 17812] [client 155.2.215.102:37991] [client 155.2.215.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aeslNOarbOEFI8qshvLJ9QAAAEI"]
[Fri Apr 24 16:09:25.226622 2026] [:error] [pid 22114:tid 22139] [client 155.2.215.107:24737] [client 155.2.215.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aeslNYAuWGz3WlMQjoe6_wAAARY"]
[Fri Apr 24 16:09:25.726136 2026] [:error] [pid 17720:tid 17766] [client 142.111.152.78:64243] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aeslNehlUs6BS3Ng7_UbFAAAAMw"]
[Fri Apr 24 16:09:26.380371 2026] [:error] [pid 17720:tid 17756] [client 155.2.215.110:46839] [client 155.2.215.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aeslNuhlUs6BS3Ng7_UbGgAAAMI"]
[Fri Apr 24 16:09:27.416082 2026] [:error] [pid 17720:tid 17762] [client 142.111.152.88:39519] [client 142.111.152.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeslN-hlUs6BS3Ng7_UbJAAAAMg"]
[Fri Apr 24 16:09:29.899053 2026] [:error] [pid 17808:tid 17818] [client 142.111.152.238:50785] [client 142.111.152.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aeslOearbOEFI8qshvLKBQAAAEg"]
[Fri Apr 24 16:09:31.458545 2026] [:error] [pid 17808:tid 17822] [client 142.111.152.78:46307] [client 142.111.152.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aeslO-arbOEFI8qshvLKEAAAAEw"]
[Fri Apr 24 16:09:32.515257 2026] [:error] [pid 17720:tid 17771] [client 142.111.152.86:28845] [client 142.111.152.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aeslPOhlUs6BS3Ng7_UbTQAAANE"]
[Fri Apr 24 16:09:33.046154 2026] [:error] [pid 17720:tid 17768] [client 155.2.215.113:61547] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aeslPehlUs6BS3Ng7_UbUwAAAM4"]
[Fri Apr 24 16:09:36.353356 2026] [:error] [pid 17720:tid 17763] [client 155.2.215.98:30305] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aeslQOhlUs6BS3Ng7_UbdAAAAMk"]
[Fri Apr 24 16:09:36.892979 2026] [:error] [pid 17808:tid 17815] [client 155.2.215.106:38535] [client 155.2.215.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aeslQOarbOEFI8qshvLKIwAAAEU"]
[Fri Apr 24 16:09:37.392961 2026] [:error] [pid 17808:tid 17823] [client 142.111.152.185:21477] [client 142.111.152.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aeslQearbOEFI8qshvLKJQAAAE0"]
[Fri Apr 24 16:09:38.356797 2026] [:error] [pid 22114:tid 22125] [client 155.2.215.98:49967] [client 155.2.215.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.2.215.98, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aeslQoAuWGz3WlMQjoe7AwAAAQg"]
[Fri Apr 24 16:09:38.866541 2026] [:error] [pid 22114:tid 22136] [client 155.2.215.98:49967] [client 155.2.215.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aeslQoAuWGz3WlMQjoe7BQAAARM"]
[Fri Apr 24 16:09:39.450083 2026] [:error] [pid 17719:tid 17742] [client 142.111.152.85:37547] [client 142.111.152.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aeslQ8TZ9gzEyL1BkPpuzgAAAI8"]
[Fri Apr 24 16:09:39.951792 2026] [:error] [pid 17808:tid 17831] [client 155.2.215.108:57781] [client 155.2.215.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aeslQ-arbOEFI8qshvLKKgAAAFU"]
[Fri Apr 24 16:09:42.270141 2026] [:error] [pid 22114:tid 22118] [client 142.111.152.202:24757] [client 142.111.152.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aeslRoAuWGz3WlMQjoe7EAAAAQE"]
[Fri Apr 24 16:09:45.353627 2026] [:error] [pid 17719:tid 17751] [client 142.111.152.82:59985] [client 142.111.152.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aeslScTZ9gzEyL1BkPpu5wAAAJg"]
[Fri Apr 24 16:09:46.345758 2026] [:error] [pid 17808:tid 17827] [client 142.111.152.186:24099] [client 142.111.152.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aeslSuarbOEFI8qshvLKMgAAAFE"]
[Fri Apr 24 16:09:50.088507 2026] [:error] [pid 17808:tid 17831] [client 155.2.215.104:45287] [client 155.2.215.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aeslTuarbOEFI8qshvLKTQAAAFU"]
[Fri Apr 24 16:09:50.649015 2026] [:error] [pid 17808:tid 17834] [client 155.2.215.99:65051] [client 155.2.215.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aeslTuarbOEFI8qshvLKUAAAAFg"]
[Fri Apr 24 16:09:51.232300 2026] [:error] [pid 17808:tid 17819] [client 155.2.215.113:54403] [client 155.2.215.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aeslT-arbOEFI8qshvLKVQAAAEk"]
[Fri Apr 24 16:09:51.766427 2026] [:error] [pid 17808:tid 17820] [client 142.111.152.77:39411] [client 142.111.152.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aeslT-arbOEFI8qshvLKWgAAAEo"]
[Fri Apr 24 16:09:53.128518 2026] [:error] [pid 17808:tid 17823] [client 155.2.215.105:31757] [client 155.2.215.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aeslUearbOEFI8qshvLKYgAAAE0"]
[Fri Apr 24 16:09:53.643221 2026] [:error] [pid 14531:tid 14554] [client 155.2.215.99:62669] [client 155.2.215.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aeslUXfLU2gw-6KR-GZyKQAAAVU"]
[Fri Apr 24 16:09:55.520763 2026] [:error] [pid 17808:tid 17829] [client 155.2.215.104:58323] [client 155.2.215.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aeslU-arbOEFI8qshvLKcgAAAFM"]
[Fri Apr 24 16:09:57.308561 2026] [:error] [pid 14531:tid 14534] [client 155.2.215.106:45541] [client 155.2.215.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aeslVXfLU2gw-6KR-GZyNwAAAUE"]
[Fri Apr 24 16:09:57.898133 2026] [:error] [pid 14531:tid 14542] [client 142.111.152.87:26413] [client 142.111.152.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aeslVXfLU2gw-6KR-GZyPAAAAUk"]
[Fri Apr 24 16:10:22.664691 2026] [autoindex:error] [pid 14531:tid 14538] [client 142.111.152.203:38825] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 18:07:33.203124 2026] [:error] [pid 4177:tid 4201] [client 43.153.35.128:49650] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aetA5X2asKnvdrSe0x6r7QAAAZA"]
[Fri Apr 24 21:15:50.835814 2026] [:error] [pid 17720:tid 17777] [client 43.157.38.131:38704] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aettBuhlUs6BS3Ng7_WweQAAANc"]
[Fri Apr 24 23:47:20.345843 2026] [:error] [pid 17720:tid 17761] [client 20.251.112.6:60421] [client 20.251.112.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/setup.php.bak"] [unique_id "aeuQiOhlUs6BS3Ng7_XwxwAAAMc"]
[Sat Apr 25 00:17:51.816564 2026] [:error] [pid 42755:tid 42767] [client 43.153.86.78:43808] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aeuXr9H7__k0j6aa603yPwAAAIo"]
[Sat Apr 25 00:28:39.978909 2026] [:error] [pid 42852:tid 42867] [client 45.131.195.110:39617] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeuaNzMEwxhhak_EhMJzsgAAAkw"]
[Sat Apr 25 06:50:40.008909 2026] [:error] [pid 46083:tid 46094] [client 185.198.240.144:47995] [client 185.198.240.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aevzwDxw_Zq74vWdjmlDQQAAAQc"]
[Sat Apr 25 09:00:24.765493 2026] [:error] [pid 46083:tid 46091] [client 52.139.225.142:4472] [client 52.139.225.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.139.225.142, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aewSKDxw_Zq74vWdjml7ugAAAQQ"]
[Sat Apr 25 09:00:25.588800 2026] [:error] [pid 46083:tid 46109] [client 52.139.225.142:4472] [client 52.139.225.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.139.225.142, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aewSKTxw_Zq74vWdjml7yQAAARU"]
[Sat Apr 25 09:00:26.722761 2026] [:error] [pid 46083:tid 46100] [client 52.139.225.142:4472] [client 52.139.225.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aewSKjxw_Zq74vWdjml73wAAAQ0"]
[Sat Apr 25 10:14:54.970591 2026] [:error] [pid 46083:tid 46088] [client 184.181.36.192:59604] [client 184.181.36.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.181.36.192, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aewjnjxw_Zq74vWdjmme9AAAAQE"]
[Sat Apr 25 10:55:45.178603 2026] [:error] [pid 46083:tid 46112] [client 45.71.146.3:30560] [client 45.71.146.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.71.146.3, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aewtMTxw_Zq74vWdjmmvywAAARg"]
[Sat Apr 25 11:53:29.749991 2026] [:error] [pid 44321:tid 44405] [client 145.239.10.137:35741] [client 145.239.10.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aew6uY1b5lV-asWa_Y54GwAAAJY"], referer: http://paramountestate.com/fm.php
[Sat Apr 25 12:23:27.587539 2026] [:error] [pid 44425:tid 44443] [client 49.234.192.248:57330] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aexBvyUl-VlItvY2tR95MwAAANA"]
[Sat Apr 25 12:25:48.692220 2026] [:error] [pid 46083:tid 46110] [client 212.237.121.7:33716] [client 212.237.121.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "aexCTDxw_Zq74vWdjmnQSwAAARY"]
[Sat Apr 25 12:25:49.457139 2026] [:error] [pid 46083:tid 46096] [client 212.237.121.7:30642] [client 212.237.121.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "aexCTTxw_Zq74vWdjmnQTwAAAQk"]
[Sat Apr 25 12:25:50.177841 2026] [:error] [pid 44320:tid 44370] [client 212.237.121.7:27840] [client 212.237.121.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "aexCTjmFqSpku_dij8iypQAAAE4"]
[Sat Apr 25 12:25:55.255332 2026] [:error] [pid 44321:tid 44406] [client 212.237.121.7:30381] [client 212.237.121.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aexCU41b5lV-asWa_Y59jgAAAJc"]
[Sat Apr 25 12:25:55.257079 2026] [:error] [pid 46083:tid 46098] [client 212.237.121.7:26308] [client 212.237.121.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "aexCUzxw_Zq74vWdjmnQWgAAAQs"]
[Sat Apr 25 17:01:42.664395 2026] [:error] [pid 44319:tid 44349] [client 43.134.141.244:43302] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aeyC9szJPAVLUb2pWtLCtgAAABQ"]
[Sat Apr 25 18:07:11.604870 2026] [:error] [pid 16195:tid 16207] [client 20.199.101.230:56167] [client 20.199.101.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeySTzVPLvrpvXaNQOn6ZQAAAAk"]
[Sat Apr 25 18:33:00.149429 2026] [:error] [pid 16195:tid 16203] [client 4.235.0.161:40095] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awa.php"] [unique_id "aeyYXDVPLvrpvXaNQOkReAAAAAU"]
[Sat Apr 25 18:33:01.344526 2026] [:error] [pid 16106:tid 16129] [client 4.235.0.161:55623] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awa.php"] [unique_id "aeyYXSGjdEsrWF7e-7McKwAAAFM"]
[Sat Apr 25 18:33:02.134443 2026] [:error] [pid 16108:tid 16175] [client 4.235.0.161:43866] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awa.php"] [unique_id "aeyYXobPF4HSQDj6WrlhIwAAAMk"]
[Sat Apr 25 18:33:02.926983 2026] [:error] [pid 16107:tid 16159] [client 4.235.0.161:57357] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/awa.php"] [unique_id "aeyYXtIfF7Hy3tw0sYRliwAAAJY"]
[Sat Apr 25 18:33:04.026652 2026] [:error] [pid 16108:tid 16180] [client 4.235.0.161:9686] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/popo.php"] [unique_id "aeyYYIbPF4HSQDj6WrlhKAAAAM4"]
[Sat Apr 25 18:33:05.461835 2026] [:error] [pid 16195:tid 16209] [client 4.235.0.161:64314] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/popo.php"] [unique_id "aeyYYTVPLvrpvXaNQOkRhAAAAAs"]
[Sat Apr 25 18:33:07.100732 2026] [:error] [pid 16195:tid 16208] [client 4.235.0.161:59176] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/popo.php"] [unique_id "aeyYYzVPLvrpvXaNQOkRiAAAAAo"]
[Sat Apr 25 18:33:07.909786 2026] [:error] [pid 16195:tid 16217] [client 4.235.0.161:40104] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/popo.php"] [unique_id "aeyYYzVPLvrpvXaNQOkRjgAAABM"]
[Sat Apr 25 18:33:08.767966 2026] [:error] [pid 16108:tid 16184] [client 4.235.0.161:40074] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "aeyYZIbPF4HSQDj6WrlhMQAAANI"]
[Sat Apr 25 18:33:09.737908 2026] [:error] [pid 16108:tid 16167] [client 4.235.0.161:62435] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "aeyYZYbPF4HSQDj6WrlhNQAAAMM"]
[Sat Apr 25 18:33:11.034036 2026] [:error] [pid 16108:tid 16179] [client 4.235.0.161:40077] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "aeyYZ4bPF4HSQDj6WrlhPAAAAM0"]
[Sat Apr 25 18:33:12.057448 2026] [:error] [pid 16195:tid 16219] [client 4.235.0.161:27863] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "aeyYaDVPLvrpvXaNQOkRnAAAABU"]
[Sat Apr 25 18:33:13.296430 2026] [:error] [pid 16107:tid 16140] [client 4.235.0.161:59139] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/11.php"] [unique_id "aeyYadIfF7Hy3tw0sYRljQAAAIM"]
[Sat Apr 25 18:33:14.018645 2026] [:error] [pid 16106:tid 16114] [client 4.235.0.161:40107] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/11.php"] [unique_id "aeyYaiGjdEsrWF7e-7McMAAAAEQ"]
[Sat Apr 25 18:33:14.700976 2026] [:error] [pid 16195:tid 16219] [client 4.235.0.161:13306] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/11.php"] [unique_id "aeyYajVPLvrpvXaNQOkRpgAAABU"]
[Sat Apr 25 18:33:15.486890 2026] [:error] [pid 16107:tid 16144] [client 4.235.0.161:40084] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/11.php"] [unique_id "aeyYa9IfF7Hy3tw0sYRlkwAAAIc"]
[Sat Apr 25 18:33:16.890980 2026] [:error] [pid 16108:tid 16184] [client 4.235.0.161:9689] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "aeyYbIbPF4HSQDj6WrlhRAAAANI"]
[Sat Apr 25 18:33:17.695696 2026] [:error] [pid 16195:tid 16221] [client 4.235.0.161:62400] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "aeyYbTVPLvrpvXaNQOkRqQAAABc"]
[Sat Apr 25 18:33:20.246115 2026] [:error] [pid 16106:tid 16121] [client 4.235.0.161:57397] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "aeyYcCGjdEsrWF7e-7McOAAAAEs"]
[Sat Apr 25 18:33:21.378973 2026] [:error] [pid 16106:tid 16114] [client 4.235.0.161:46900] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/p.php"] [unique_id "aeyYcSGjdEsrWF7e-7McPAAAAEQ"]
[Sat Apr 25 18:33:22.832045 2026] [:error] [pid 16195:tid 16214] [client 4.235.0.161:8556] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/"] [unique_id "aeyYcjVPLvrpvXaNQOkRuQAAABA"]
[Sat Apr 25 18:33:24.147216 2026] [:error] [pid 16108:tid 16190] [client 4.235.0.161:18764] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/"] [unique_id "aeyYdIbPF4HSQDj6WrlhUQAAANg"]
[Sat Apr 25 18:33:25.282871 2026] [:error] [pid 16195:tid 16199] [client 4.235.0.161:12573] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/"] [unique_id "aeyYdTVPLvrpvXaNQOkRxQAAAAE"]
[Sat Apr 25 18:33:27.615218 2026] [:error] [pid 16195:tid 16207] [client 4.235.0.161:40104] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/"] [unique_id "aeyYdzVPLvrpvXaNQOkRzQAAAAk"]
[Sat Apr 25 18:33:29.583604 2026] [:error] [pid 16108:tid 16164] [client 4.235.0.161:62446] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bthil.php"] [unique_id "aeyYeYbPF4HSQDj6WrlhXAAAAMA"]
[Sat Apr 25 18:33:31.470779 2026] [:error] [pid 16108:tid 16181] [client 4.235.0.161:44532] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bthil.php"] [unique_id "aeyYe4bPF4HSQDj6WrlhYQAAAM8"]
[Sat Apr 25 18:33:32.224101 2026] [:error] [pid 16107:tid 16142] [client 4.235.0.161:27880] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bthil.php"] [unique_id "aeyYfNIfF7Hy3tw0sYRlpQAAAIU"]
[Sat Apr 25 18:33:33.988075 2026] [:error] [pid 16108:tid 16169] [client 4.235.0.161:55991] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/bthil.php"] [unique_id "aeyYfYbPF4HSQDj6WrlhZQAAAMU"]
[Sat Apr 25 18:33:35.015661 2026] [:error] [pid 16108:tid 16187] [client 4.235.0.161:27871] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "aeyYf4bPF4HSQDj6WrlhawAAANU"]
[Sat Apr 25 18:33:35.665497 2026] [:error] [pid 16107:tid 16152] [client 4.235.0.161:2850] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "aeyYf9IfF7Hy3tw0sYRlrwAAAI8"]
[Sat Apr 25 18:33:36.323711 2026] [:error] [pid 16195:tid 16222] [client 4.235.0.161:17645] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "aeyYgDVPLvrpvXaNQOkR2AAAABg"]
[Sat Apr 25 18:33:37.220024 2026] [:error] [pid 16108:tid 16184] [client 4.235.0.161:27878] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "aeyYgYbPF4HSQDj6WrlhdAAAANI"]
[Sat Apr 25 18:33:38.012580 2026] [:error] [pid 16106:tid 16126] [client 4.235.0.161:17619] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/seo.php"] [unique_id "aeyYgiGjdEsrWF7e-7McXQAAAFA"]
[Sat Apr 25 18:33:38.675714 2026] [:error] [pid 16195:tid 16221] [client 4.235.0.161:26426] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/seo.php"] [unique_id "aeyYgjVPLvrpvXaNQOkR4QAAABc"]
[Sat Apr 25 18:33:39.663426 2026] [:error] [pid 16107:tid 16153] [client 4.235.0.161:24845] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/seo.php"] [unique_id "aeyYg9IfF7Hy3tw0sYRlxAAAAJA"]
[Sat Apr 25 18:33:40.576002 2026] [:error] [pid 16195:tid 16220] [client 4.235.0.161:17652] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/seo.php"] [unique_id "aeyYhDVPLvrpvXaNQOkR5wAAABY"]
[Sat Apr 25 18:33:42.019360 2026] [:error] [pid 16195:tid 16219] [client 4.235.0.161:44512] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/7.php"] [unique_id "aeyYhjVPLvrpvXaNQOkR7AAAABU"]
[Sat Apr 25 18:33:42.842595 2026] [:error] [pid 16107:tid 16140] [client 4.235.0.161:18799] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/7.php"] [unique_id "aeyYhtIfF7Hy3tw0sYRlzwAAAIM"]
[Sat Apr 25 18:33:43.773653 2026] [:error] [pid 16195:tid 16218] [client 4.235.0.161:44489] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/7.php"] [unique_id "aeyYhzVPLvrpvXaNQOkR9AAAABQ"]
[Sat Apr 25 18:33:44.557250 2026] [:error] [pid 16108:tid 16188] [client 4.235.0.161:44528] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/7.php"] [unique_id "aeyYiIbPF4HSQDj6WrlhhgAAANY"]
[Sat Apr 25 18:33:47.295013 2026] [:error] [pid 16107:tid 16148] [client 4.235.0.161:55997] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8.php"] [unique_id "aeyYi9IfF7Hy3tw0sYRl3AAAAIs"]
[Sat Apr 25 18:33:51.525385 2026] [:error] [pid 16107:tid 16142] [client 4.235.0.161:44517] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/8.php"] [unique_id "aeyYj9IfF7Hy3tw0sYRl4QAAAIU"]
[Sat Apr 25 18:34:10.321429 2026] [:error] [pid 16106:tid 16121] [client 4.235.0.161:17616] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aeyYoiGjdEsrWF7e-7McpQAAAEs"]
[Sat Apr 25 18:34:11.541163 2026] [:error] [pid 16108:tid 16173] [client 4.235.0.161:65131] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aeyYo4bPF4HSQDj6Wrlh0QAAAMc"]
[Sat Apr 25 18:34:12.773678 2026] [:error] [pid 16195:tid 16201] [client 4.235.0.161:2371] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aeyYpDVPLvrpvXaNQOkSXQAAAAM"]
[Sat Apr 25 18:34:13.587004 2026] [:error] [pid 16106:tid 16121] [client 4.235.0.161:30745] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/1.php"] [unique_id "aeyYpSGjdEsrWF7e-7McrwAAAEs"]
[Sat Apr 25 18:34:15.665470 2026] [:error] [pid 16106:tid 16126] [client 4.235.0.161:10085] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2.php"] [unique_id "aeyYpyGjdEsrWF7e-7MctAAAAFA"]
[Sat Apr 25 18:34:16.916430 2026] [:error] [pid 16107:tid 16142] [client 4.235.0.161:42659] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2.php"] [unique_id "aeyYqNIfF7Hy3tw0sYRmMwAAAIU"]
[Sat Apr 25 18:34:18.108829 2026] [:error] [pid 16108:tid 16177] [client 4.235.0.161:2381] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2.php"] [unique_id "aeyYqobPF4HSQDj6Wrlh6gAAAMs"]
[Sat Apr 25 18:34:19.682560 2026] [:error] [pid 16107:tid 16156] [client 4.235.0.161:26466] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2.php"] [unique_id "aeyYq9IfF7Hy3tw0sYRmOwAAAJM"]
[Sat Apr 25 18:34:20.775193 2026] [:error] [pid 16106:tid 16114] [client 4.235.0.161:40165] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3.php"] [unique_id "aeyYrCGjdEsrWF7e-7McvAAAAEQ"]
[Sat Apr 25 18:34:23.132609 2026] [:error] [pid 16107:tid 16156] [client 4.235.0.161:14595] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3.php"] [unique_id "aeyYr9IfF7Hy3tw0sYRmYQAAAJM"]
[Sat Apr 25 18:34:24.157048 2026] [:error] [pid 16106:tid 16117] [client 4.235.0.161:26432] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3.php"] [unique_id "aeyYsCGjdEsrWF7e-7Mc2gAAAEc"]
[Sat Apr 25 18:34:26.732068 2026] [:error] [pid 16195:tid 16198] [client 4.235.0.161:2414] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/3.php"] [unique_id "aeyYsjVPLvrpvXaNQOkSmQAAAAA"]
[Sat Apr 25 18:34:27.859687 2026] [:error] [pid 29049:tid 29053] [client 4.235.0.161:2414] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/4.php"] [unique_id "aeyYsyfsWHIvmg63qcVekwAAAQI"]
[Sat Apr 25 18:34:28.792629 2026] [:error] [pid 29049:tid 29060] [client 4.235.0.161:10109] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/4.php"] [unique_id "aeyYtCfsWHIvmg63qcVenAAAAQk"]
[Sat Apr 25 18:34:29.792763 2026] [:error] [pid 16107:tid 16151] [client 4.235.0.161:29297] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/4.php"] [unique_id "aeyYtdIfF7Hy3tw0sYRmZAAAAI4"]
[Sat Apr 25 18:34:31.372184 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:29274] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/4.php"] [unique_id "aeyYtyfsWHIvmg63qcVeqQAAAQE"]
[Sat Apr 25 18:34:32.067787 2026] [:error] [pid 16106:tid 16115] [client 4.235.0.161:22131] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5.php"] [unique_id "aeyYuCGjdEsrWF7e-7Mc4QAAAEU"]
[Sat Apr 25 18:34:32.818125 2026] [:error] [pid 16106:tid 16119] [client 4.235.0.161:49820] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5.php"] [unique_id "aeyYuCGjdEsrWF7e-7Mc4wAAAEk"]
[Sat Apr 25 18:34:35.040299 2026] [:error] [pid 16106:tid 16121] [client 4.235.0.161:65094] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5.php"] [unique_id "aeyYuyGjdEsrWF7e-7Mc5QAAAEs"]
[Sat Apr 25 18:34:36.120455 2026] [:error] [pid 29049:tid 29056] [client 4.235.0.161:10052] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/5.php"] [unique_id "aeyYvCfsWHIvmg63qcVerwAAAQU"]
[Sat Apr 25 18:34:38.193517 2026] [:error] [pid 16106:tid 16127] [client 4.235.0.161:15168] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6.php"] [unique_id "aeyYviGjdEsrWF7e-7Mc6AAAAFE"]
[Sat Apr 25 18:34:39.305052 2026] [:error] [pid 16106:tid 16110] [client 4.235.0.161:19417] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6.php"] [unique_id "aeyYvyGjdEsrWF7e-7Mc6QAAAEA"]
[Sat Apr 25 18:34:41.134010 2026] [:error] [pid 16106:tid 16130] [client 4.235.0.161:15209] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6.php"] [unique_id "aeyYwSGjdEsrWF7e-7Mc7wAAAFQ"]
[Sat Apr 25 18:34:41.988139 2026] [:error] [pid 16108:tid 16181] [client 4.235.0.161:42687] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/6.php"] [unique_id "aeyYwYbPF4HSQDj6WrliGwAAAM8"]
[Sat Apr 25 18:34:43.058608 2026] [:error] [pid 16108:tid 16187] [client 4.235.0.161:37821] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9.php"] [unique_id "aeyYw4bPF4HSQDj6WrliHQAAANU"]
[Sat Apr 25 18:34:47.702017 2026] [:error] [pid 29049:tid 29051] [client 4.235.0.161:2095] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9.php"] [unique_id "aeyYxyfsWHIvmg63qcVe2AAAAQA"]
[Sat Apr 25 18:34:48.472283 2026] [:error] [pid 29049:tid 29055] [client 4.235.0.161:37806] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9.php"] [unique_id "aeyYyCfsWHIvmg63qcVe3AAAAQQ"]
[Sat Apr 25 18:34:49.196737 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:14296] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/9.php"] [unique_id "aeyYySfsWHIvmg63qcVe3gAAARc"]
[Sat Apr 25 18:34:49.883994 2026] [:error] [pid 16107:tid 16156] [client 4.235.0.161:10055] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/10.php"] [unique_id "aeyYydIfF7Hy3tw0sYRmcgAAAJM"]
[Sat Apr 25 18:34:50.764139 2026] [:error] [pid 16195:tid 16221] [client 4.235.0.161:65109] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/10.php"] [unique_id "aeyYyjVPLvrpvXaNQOkSzwAAABc"]
[Sat Apr 25 18:34:51.539453 2026] [:error] [pid 16108:tid 16184] [client 4.235.0.161:38951] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/10.php"] [unique_id "aeyYy4bPF4HSQDj6WrliJQAAANI"]
[Sat Apr 25 18:34:52.580574 2026] [:error] [pid 16108:tid 16188] [client 4.235.0.161:15193] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/10.php"] [unique_id "aeyYzIbPF4HSQDj6WrliJgAAANY"]
[Sat Apr 25 18:34:53.281097 2026] [:error] [pid 16108:tid 16166] [client 4.235.0.161:14638] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "aeyYzYbPF4HSQDj6WrliJwAAAMI"]
[Sat Apr 25 18:34:54.071747 2026] [:error] [pid 16106:tid 16112] [client 4.235.0.161:10069] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "aeyYziGjdEsrWF7e-7MdDAAAAEI"]
[Sat Apr 25 18:34:55.015172 2026] [:error] [pid 16106:tid 16115] [client 4.235.0.161:2400] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "aeyYzyGjdEsrWF7e-7MdEAAAAEU"]
[Sat Apr 25 18:34:56.310680 2026] [:error] [pid 16106:tid 16111] [client 4.235.0.161:37788] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/100.php"] [unique_id "aeyY0CGjdEsrWF7e-7MdFAAAAEE"]
[Sat Apr 25 18:34:56.919673 2026] [:error] [pid 16106:tid 16132] [client 4.235.0.161:26487] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/nastar.php"] [unique_id "aeyY0CGjdEsrWF7e-7MdFgAAAFY"]
[Sat Apr 25 18:34:57.975098 2026] [:error] [pid 29049:tid 29073] [client 4.235.0.161:2404] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/nastar.php"] [unique_id "aeyY0SfsWHIvmg63qcVe8QAAARY"]
[Sat Apr 25 18:34:58.646126 2026] [:error] [pid 29049:tid 29067] [client 4.235.0.161:26488] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/nastar.php"] [unique_id "aeyY0ifsWHIvmg63qcVe9AAAARA"]
[Sat Apr 25 18:34:59.511709 2026] [:error] [pid 16106:tid 16114] [client 4.235.0.161:2094] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.well-known/nastar.php"] [unique_id "aeyY0yGjdEsrWF7e-7MdGgAAAEQ"]
[Sat Apr 25 18:35:00.389955 2026] [:error] [pid 16106:tid 16115] [client 4.235.0.161:17574] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2026w.php"] [unique_id "aeyY1CGjdEsrWF7e-7MdHQAAAEU"]
[Sat Apr 25 18:35:01.512072 2026] [:error] [pid 16107:tid 16140] [client 4.235.0.161:65091] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2026w.php"] [unique_id "aeyY1dIfF7Hy3tw0sYRmewAAAIM"]
[Sat Apr 25 18:35:02.342705 2026] [:error] [pid 16106:tid 16118] [client 4.235.0.161:29283] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2026w.php"] [unique_id "aeyY1iGjdEsrWF7e-7MdIQAAAEg"]
[Sat Apr 25 18:35:03.285229 2026] [:error] [pid 29049:tid 29053] [client 4.235.0.161:2082] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/2026w.php"] [unique_id "aeyY1yfsWHIvmg63qcVe-QAAAQI"]
[Sat Apr 25 18:35:04.237264 2026] [:error] [pid 29049:tid 29073] [client 4.235.0.161:2396] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwpg.php"] [unique_id "aeyY2CfsWHIvmg63qcVe_AAAARY"]
[Sat Apr 25 18:35:05.368850 2026] [:error] [pid 16107:tid 16158] [client 4.235.0.161:19392] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwpg.php"] [unique_id "aeyY2dIfF7Hy3tw0sYRmhAAAAJU"]
[Sat Apr 25 18:35:06.513300 2026] [:error] [pid 29049:tid 29072] [client 4.235.0.161:36547] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwpg.php"] [unique_id "aeyY2ifsWHIvmg63qcVfBwAAARU"]
[Sat Apr 25 18:35:07.578753 2026] [:error] [pid 29049:tid 29069] [client 4.235.0.161:43350] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwpg.php"] [unique_id "aeyY2yfsWHIvmg63qcVfDwAAARI"]
[Sat Apr 25 18:35:26.783145 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:33740] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeyY7ifsWHIvmg63qcVfVgAAARc"]
[Sat Apr 25 18:35:27.749969 2026] [:error] [pid 16108:tid 16176] [client 4.235.0.161:18691] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeyY74bPF4HSQDj6WrliUAAAAMo"]
[Sat Apr 25 18:35:28.466454 2026] [:error] [pid 16106:tid 16115] [client 4.235.0.161:14334] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeyY8CGjdEsrWF7e-7MdOgAAAEU"]
[Sat Apr 25 18:35:29.128936 2026] [:error] [pid 29049:tid 29057] [client 4.235.0.161:2199] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ioxi-o.php"] [unique_id "aeyY8SfsWHIvmg63qcVfWgAAAQY"]
[Sat Apr 25 18:35:29.861254 2026] [:error] [pid 29049:tid 29058] [client 4.235.0.161:11900] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyY8SfsWHIvmg63qcVfXAAAAQc"]
[Sat Apr 25 18:35:30.681914 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:65398] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyY8ifsWHIvmg63qcVfYAAAARc"]
[Sat Apr 25 18:35:32.442423 2026] [:error] [pid 16107:tid 16152] [client 4.235.0.161:43367] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyY9NIfF7Hy3tw0sYRmngAAAI8"]
[Sat Apr 25 18:35:34.037891 2026] [:error] [pid 16195:tid 16213] [client 4.235.0.161:14320] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyY9jVPLvrpvXaNQOkS4QAAAA8"]
[Sat Apr 25 18:35:34.870531 2026] [:error] [pid 16195:tid 16218] [client 4.235.0.161:55580] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "aeyY9jVPLvrpvXaNQOkS4wAAABQ"]
[Sat Apr 25 18:35:35.844607 2026] [:error] [pid 16195:tid 16210] [client 4.235.0.161:37208] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "aeyY9zVPLvrpvXaNQOkS6QAAAAw"]
[Sat Apr 25 18:35:37.420593 2026] [:error] [pid 29049:tid 29063] [client 4.235.0.161:55600] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "aeyY-SfsWHIvmg63qcVfcwAAAQw"]
[Sat Apr 25 18:35:38.631121 2026] [:error] [pid 16106:tid 16127] [client 4.235.0.161:18741] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/66.php"] [unique_id "aeyY-iGjdEsrWF7e-7MdPwAAAFE"]
[Sat Apr 25 18:35:39.699302 2026] [:error] [pid 16106:tid 16110] [client 4.235.0.161:38975] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "aeyY-yGjdEsrWF7e-7MdRQAAAEA"]
[Sat Apr 25 18:35:40.482514 2026] [:error] [pid 16106:tid 16128] [client 4.235.0.161:11903] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "aeyY_CGjdEsrWF7e-7MdRwAAAFI"]
[Sat Apr 25 18:35:42.437566 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:2201] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "aeyY_ifsWHIvmg63qcVffgAAAQE"]
[Sat Apr 25 18:35:43.905540 2026] [:error] [pid 29049:tid 29075] [client 4.235.0.161:14299] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/a5.php"] [unique_id "aeyY_yfsWHIvmg63qcVfgAAAARg"]
[Sat Apr 25 18:35:44.636046 2026] [:error] [pid 29049:tid 29062] [client 4.235.0.161:37231] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aeyZACfsWHIvmg63qcVfgQAAAQs"]
[Sat Apr 25 18:35:45.902334 2026] [:error] [pid 29049:tid 29066] [client 4.235.0.161:42678] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aeyZASfsWHIvmg63qcVfhQAAAQ8"]
[Sat Apr 25 18:35:46.825527 2026] [:error] [pid 16106:tid 16110] [client 4.235.0.161:42675] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aeyZAiGjdEsrWF7e-7MdUQAAAEA"]
[Sat Apr 25 18:35:47.511879 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:11856] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ol.php"] [unique_id "aeyZAyfsWHIvmg63qcVfjgAAARc"]
[Sat Apr 25 18:35:48.474268 2026] [:error] [pid 29049:tid 29057] [client 4.235.0.161:50621] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aeyZBCfsWHIvmg63qcVfkwAAAQY"]
[Sat Apr 25 18:35:49.224816 2026] [:error] [pid 29049:tid 29071] [client 4.235.0.161:50581] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aeyZBSfsWHIvmg63qcVflQAAARQ"]
[Sat Apr 25 18:35:50.384907 2026] [:error] [pid 16108:tid 16170] [client 4.235.0.161:2061] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/f6.php"] [unique_id "aeyZBobPF4HSQDj6WrliYgAAAMY"]
[Sat Apr 25 18:35:51.106869 2026] [:error] [pid 29049:tid 29070] [client 4.235.0.161:37226] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeyZByfsWHIvmg63qcVfmwAAARM"]
[Sat Apr 25 18:35:52.157329 2026] [:error] [pid 29049:tid 29051] [client 4.235.0.161:36551] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeyZCCfsWHIvmg63qcVfnwAAAQA"]
[Sat Apr 25 18:35:53.262982 2026] [:error] [pid 16195:tid 16201] [client 4.235.0.161:2196] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeyZCTVPLvrpvXaNQOkS-wAAAAM"]
[Sat Apr 25 18:35:53.814043 2026] [:error] [pid 29049:tid 29069] [client 4.235.0.161:15181] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "aeyZCSfsWHIvmg63qcVfoQAAARI"]
[Sat Apr 25 18:35:54.686922 2026] [:error] [pid 16195:tid 16213] [client 4.235.0.161:37196] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "aeyZCjVPLvrpvXaNQOkTAAAAAA8"]
[Sat Apr 25 18:35:55.480675 2026] [:error] [pid 16107:tid 16142] [client 4.235.0.161:42630] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "aeyZC9IfF7Hy3tw0sYRmnwAAAIU"]
[Sat Apr 25 18:35:56.368934 2026] [:error] [pid 16107:tid 16141] [client 4.235.0.161:37184] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "aeyZDNIfF7Hy3tw0sYRmoAAAAIQ"]
[Sat Apr 25 18:35:57.370516 2026] [:error] [pid 16195:tid 16202] [client 4.235.0.161:37205] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "aeyZDTVPLvrpvXaNQOkTCQAAAAQ"]
[Sat Apr 25 18:35:58.114004 2026] [:error] [pid 16107:tid 16160] [client 4.235.0.161:32349] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "aeyZDtIfF7Hy3tw0sYRmpAAAAJc"]
[Sat Apr 25 18:35:58.918823 2026] [:error] [pid 16195:tid 16210] [client 4.235.0.161:50603] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "aeyZDjVPLvrpvXaNQOkTDgAAAAw"]
[Sat Apr 25 18:36:00.277681 2026] [:error] [pid 29049:tid 29068] [client 4.235.0.161:36565] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "aeyZECfsWHIvmg63qcVfrgAAARE"]
[Sat Apr 25 18:36:01.279973 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:36586] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/av.php"] [unique_id "aeyZESfsWHIvmg63qcVfsgAAAQE"]
[Sat Apr 25 18:36:02.315285 2026] [:error] [pid 16107:tid 16139] [client 4.235.0.161:11894] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeyZEtIfF7Hy3tw0sYRmpQAAAII"]
[Sat Apr 25 18:36:03.133114 2026] [:error] [pid 16107:tid 16147] [client 4.235.0.161:26459] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeyZE9IfF7Hy3tw0sYRmpgAAAIo"]
[Sat Apr 25 18:36:04.778978 2026] [:error] [pid 16107:tid 16146] [client 4.235.0.161:26436] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeyZFNIfF7Hy3tw0sYRmqgAAAIk"]
[Sat Apr 25 18:36:07.151799 2026] [:error] [pid 29049:tid 29058] [client 4.235.0.161:49842] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeyZFyfsWHIvmg63qcVfxQAAAQc"]
[Sat Apr 25 18:36:31.381057 2026] [:error] [pid 16195:tid 16201] [client 4.235.0.161:17643] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyZLzVPLvrpvXaNQOkTKAAAAAM"]
[Sat Apr 25 18:36:32.569431 2026] [:error] [pid 16195:tid 16222] [client 4.235.0.161:30739] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyZMDVPLvrpvXaNQOkTLgAAABg"]
[Sat Apr 25 18:36:34.923051 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:58123] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyZMifsWHIvmg63qcVgEgAAARc"]
[Sat Apr 25 18:36:36.248593 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:42078] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "aeyZNCfsWHIvmg63qcVgGwAAAQE"]
[Sat Apr 25 18:36:37.033746 2026] [:error] [pid 29049:tid 29059] [client 4.235.0.161:65130] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZNSfsWHIvmg63qcVgHgAAAQg"]
[Sat Apr 25 18:36:38.181628 2026] [:error] [pid 29049:tid 29058] [client 4.235.0.161:23543] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZNifsWHIvmg63qcVgIwAAAQc"]
[Sat Apr 25 18:36:38.993906 2026] [:error] [pid 29049:tid 29053] [client 4.235.0.161:20839] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZNifsWHIvmg63qcVgJwAAAQI"]
[Sat Apr 25 18:36:40.123966 2026] [:error] [pid 29049:tid 29055] [client 4.235.0.161:23528] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZOCfsWHIvmg63qcVgKwAAAQQ"]
[Sat Apr 25 18:36:40.899172 2026] [:error] [pid 16195:tid 16198] [client 4.235.0.161:38963] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "aeyZODVPLvrpvXaNQOkTNQAAAAA"]
[Sat Apr 25 18:36:41.622285 2026] [:error] [pid 16108:tid 16187] [client 4.235.0.161:53738] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "aeyZOYbPF4HSQDj6WrligAAAANU"]
[Sat Apr 25 18:36:42.583451 2026] [:error] [pid 29049:tid 29062] [client 4.235.0.161:2425] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "aeyZOifsWHIvmg63qcVgLgAAAQs"]
[Sat Apr 25 18:36:43.513354 2026] [:error] [pid 29049:tid 29059] [client 4.235.0.161:14622] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/adminfuns.php"] [unique_id "aeyZOyfsWHIvmg63qcVgMgAAAQg"]
[Sat Apr 25 18:36:44.390261 2026] [:error] [pid 16106:tid 16111] [client 4.235.0.161:2955] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aeyZPCGjdEsrWF7e-7MdjAAAAEE"]
[Sat Apr 25 18:36:45.362997 2026] [:error] [pid 16195:tid 16218] [client 4.235.0.161:42091] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aeyZPTVPLvrpvXaNQOkTOAAAABQ"]
[Sat Apr 25 18:36:46.101972 2026] [:error] [pid 16106:tid 16127] [client 4.235.0.161:2390] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aeyZPiGjdEsrWF7e-7MdkwAAAFE"]
[Sat Apr 25 18:36:47.258216 2026] [:error] [pid 16195:tid 16214] [client 4.235.0.161:11170] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/goods.php"] [unique_id "aeyZPzVPLvrpvXaNQOkTOwAAABA"]
[Sat Apr 25 18:36:49.225945 2026] [:error] [pid 16195:tid 16209] [client 4.235.0.161:58144] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZQTVPLvrpvXaNQOkTPwAAAAs"]
[Sat Apr 25 18:36:49.876443 2026] [:error] [pid 16108:tid 16183] [client 4.235.0.161:58133] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZQYbPF4HSQDj6WrlihgAAANE"]
[Sat Apr 25 18:36:50.928400 2026] [:error] [pid 16106:tid 16126] [client 4.235.0.161:38959] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZQiGjdEsrWF7e-7MdmwAAAFA"]
[Sat Apr 25 18:36:52.549207 2026] [:error] [pid 16195:tid 16216] [client 4.235.0.161:10092] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ms-edit.php"] [unique_id "aeyZRDVPLvrpvXaNQOkTRQAAABI"]
[Sat Apr 25 18:36:53.749941 2026] [:error] [pid 16107:tid 16161] [client 4.235.0.161:40129] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "aeyZRdIfF7Hy3tw0sYRm1gAAAJg"]
[Sat Apr 25 18:36:54.927902 2026] [:error] [pid 16107:tid 16146] [client 4.235.0.161:42648] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "aeyZRtIfF7Hy3tw0sYRm3gAAAIk"]
[Sat Apr 25 18:36:55.788283 2026] [:error] [pid 16108:tid 16178] [client 4.235.0.161:38922] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "aeyZR4bPF4HSQDj6WrliiwAAAMw"]
[Sat Apr 25 18:36:56.576581 2026] [:error] [pid 16106:tid 16111] [client 4.235.0.161:65100] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/222.php"] [unique_id "aeyZSCGjdEsrWF7e-7MdoAAAAEE"]
[Sat Apr 25 18:36:58.104447 2026] [:error] [pid 16106:tid 16132] [client 4.235.0.161:2051] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "aeyZSiGjdEsrWF7e-7MdpAAAAFY"]
[Sat Apr 25 18:36:59.083849 2026] [:error] [pid 29049:tid 29070] [client 4.235.0.161:10067] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "aeyZSyfsWHIvmg63qcVgOAAAARM"]
[Sat Apr 25 18:37:00.067751 2026] [:error] [pid 16106:tid 16133] [client 4.235.0.161:36548] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "aeyZTCGjdEsrWF7e-7MdqQAAAFc"]
[Sat Apr 25 18:37:00.783602 2026] [:error] [pid 16195:tid 16200] [client 4.235.0.161:19422] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/cgi-bin/index.php"] [unique_id "aeyZTDVPLvrpvXaNQOkTTAAAAAI"]
[Sat Apr 25 18:37:02.027664 2026] [:error] [pid 16108:tid 16189] [client 4.235.0.161:10077] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "aeyZTobPF4HSQDj6WrlikQAAANc"]
[Sat Apr 25 18:37:03.443589 2026] [:error] [pid 29049:tid 29053] [client 4.235.0.161:8539] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "aeyZTyfsWHIvmg63qcVgQAAAAQI"]
[Sat Apr 25 18:37:04.851811 2026] [:error] [pid 16195:tid 16204] [client 4.235.0.161:7933] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "aeyZUDVPLvrpvXaNQOkTTgAAAAY"]
[Sat Apr 25 18:37:06.218097 2026] [:error] [pid 16108:tid 16173] [client 4.235.0.161:42081] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/fff.php"] [unique_id "aeyZUobPF4HSQDj6WrlilQAAAMc"]
[Sat Apr 25 18:37:07.212101 2026] [:error] [pid 16195:tid 16206] [client 4.235.0.161:44530] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZUzVPLvrpvXaNQOkTUQAAAAg"]
[Sat Apr 25 18:37:08.014985 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:55966] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZVCfsWHIvmg63qcVgUwAAAQE"]
[Sat Apr 25 18:37:09.011572 2026] [:error] [pid 29049:tid 29053] [client 4.235.0.161:24866] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZVSfsWHIvmg63qcVgWgAAAQI"]
[Sat Apr 25 18:37:11.159530 2026] [:error] [pid 16108:tid 16167] [client 4.235.0.161:17078] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZV4bPF4HSQDj6WrlimAAAAMM"]
[Sat Apr 25 18:37:11.951830 2026] [:error] [pid 16195:tid 16221] [client 4.235.0.161:54265] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "aeyZVzVPLvrpvXaNQOkTWAAAABc"]
[Sat Apr 25 18:37:12.788713 2026] [:error] [pid 29049:tid 29065] [client 4.235.0.161:40804] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "aeyZWCfsWHIvmg63qcVgYwAAAQ4"]
[Sat Apr 25 18:37:13.427115 2026] [:error] [pid 16108:tid 16185] [client 4.235.0.161:54259] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "aeyZWYbPF4HSQDj6WrlimwAAANM"]
[Sat Apr 25 18:37:14.034315 2026] [:error] [pid 16195:tid 16201] [client 4.235.0.161:17028] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/makeasmtp.php"] [unique_id "aeyZWjVPLvrpvXaNQOkTWwAAAAM"]
[Sat Apr 25 18:37:14.983467 2026] [:error] [pid 16107:tid 16151] [client 4.235.0.161:44541] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin1.php"] [unique_id "aeyZWtIfF7Hy3tw0sYRm6AAAAI4"]
[Sat Apr 25 18:37:16.034342 2026] [:error] [pid 29049:tid 29051] [client 4.235.0.161:55943] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin1.php"] [unique_id "aeyZXCfsWHIvmg63qcVgbAAAAQA"]
[Sat Apr 25 18:37:16.710672 2026] [:error] [pid 16108:tid 16174] [client 4.235.0.161:7835] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin1.php"] [unique_id "aeyZXIbPF4HSQDj6WrlinwAAAMg"]
[Sat Apr 25 18:37:17.506081 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:53757] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin1.php"] [unique_id "aeyZXSfsWHIvmg63qcVgcQAAAQE"]
[Sat Apr 25 18:37:18.757821 2026] [:error] [pid 29049:tid 29070] [client 4.235.0.161:48900] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeyZXifsWHIvmg63qcVgdgAAARM"]
[Sat Apr 25 18:37:19.616052 2026] [:error] [pid 16107:tid 16157] [client 4.235.0.161:13226] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeyZX9IfF7Hy3tw0sYRm8AAAAJQ"]
[Sat Apr 25 18:37:20.461065 2026] [:error] [pid 29049:tid 29055] [client 4.235.0.161:2960] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeyZYCfsWHIvmg63qcVgfQAAAQQ"]
[Sat Apr 25 18:37:21.296098 2026] [:error] [pid 16106:tid 16114] [client 4.235.0.161:24856] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeyZYSGjdEsrWF7e-7MdvAAAAEQ"]
[Sat Apr 25 18:37:22.188081 2026] [:error] [pid 16106:tid 16122] [client 4.235.0.161:46877] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/BDKR28WP.php"] [unique_id "aeyZYiGjdEsrWF7e-7MdwQAAAEw"]
[Sat Apr 25 18:37:23.105482 2026] [:error] [pid 29049:tid 29065] [client 4.235.0.161:2298] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/BDKR28WP.php"] [unique_id "aeyZYyfsWHIvmg63qcVghAAAAQ4"]
[Sat Apr 25 18:37:23.749042 2026] [:error] [pid 29049:tid 29054] [client 4.235.0.161:53708] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/BDKR28WP.php"] [unique_id "aeyZYyfsWHIvmg63qcVghgAAAQM"]
[Sat Apr 25 18:37:24.509265 2026] [:error] [pid 29049:tid 29052] [client 4.235.0.161:17030] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/BDKR28WP.php"] [unique_id "aeyZZCfsWHIvmg63qcVgiAAAAQE"]
[Sat Apr 25 18:37:25.245022 2026] [:error] [pid 16106:tid 16130] [client 4.235.0.161:17614] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/"] [unique_id "aeyZZSGjdEsrWF7e-7Md0AAAAFQ"]
[Sat Apr 25 18:37:26.096723 2026] [:error] [pid 16106:tid 16126] [client 4.235.0.161:8557] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/"] [unique_id "aeyZZiGjdEsrWF7e-7Md5gAAAFA"]
[Sat Apr 25 18:37:26.784081 2026] [:error] [pid 16107:tid 16153] [client 4.235.0.161:26423] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/"] [unique_id "aeyZZtIfF7Hy3tw0sYRm9gAAAJA"]
[Sat Apr 25 18:37:28.111455 2026] [:error] [pid 29049:tid 29058] [client 4.235.0.161:17629] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/"] [unique_id "aeyZaCfsWHIvmg63qcVgngAAAQc"]
[Sat Apr 25 18:37:28.941575 2026] [:error] [pid 16107:tid 16159] [client 4.235.0.161:10484] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/"] [unique_id "aeyZaNIfF7Hy3tw0sYRm9wAAAJY"]
[Sat Apr 25 18:37:36.610603 2026] [:error] [pid 16195:tid 16208] [client 4.235.0.161:44531] [client 4.235.0.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeyZcDVPLvrpvXaNQOkThwAAAAo"]
[Sat Apr 25 18:37:48.400108 2026] [:error] [pid 29049:tid 29057] [client 4.235.0.161:17615] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeyZfCfsWHIvmg63qcVg2wAAAQY"]
[Sat Apr 25 18:37:49.087878 2026] [:error] [pid 29049:tid 29064] [client 4.235.0.161:27887] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeyZfSfsWHIvmg63qcVg3gAAAQ0"]
[Sat Apr 25 18:37:49.899346 2026] [:error] [pid 29049:tid 29072] [client 4.235.0.161:18806] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeyZfSfsWHIvmg63qcVg4QAAARU"]
[Sat Apr 25 18:37:50.855508 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:20135] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeyZfifsWHIvmg63qcVg5QAAARc"]
[Sat Apr 25 18:37:51.652960 2026] [:error] [pid 16106:tid 16129] [client 4.235.0.161:45143] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "aeyZfyGjdEsrWF7e-7MeiQAAAFM"]
[Sat Apr 25 18:37:52.382803 2026] [:error] [pid 29049:tid 29066] [client 4.235.0.161:8037] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "aeyZgCfsWHIvmg63qcVg7QAAAQ8"]
[Sat Apr 25 18:37:53.118670 2026] [:error] [pid 29049:tid 29065] [client 4.235.0.161:2953] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "aeyZgSfsWHIvmg63qcVg8AAAAQ4"]
[Sat Apr 25 18:37:54.020408 2026] [:error] [pid 29049:tid 29054] [client 4.235.0.161:2282] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/axx.php"] [unique_id "aeyZgifsWHIvmg63qcVg9gAAAQM"]
[Sat Apr 25 18:37:54.936887 2026] [:error] [pid 29049:tid 29065] [client 4.235.0.161:20133] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "aeyZgifsWHIvmg63qcVg_AAAAQ4"]
[Sat Apr 25 18:37:55.630069 2026] [:error] [pid 29049:tid 29075] [client 4.235.0.161:8056] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "aeyZgyfsWHIvmg63qcVhAAAAARg"]
[Sat Apr 25 18:37:56.407329 2026] [:error] [pid 29049:tid 29066] [client 4.235.0.161:13271] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "aeyZhCfsWHIvmg63qcVhBAAAAQ8"]
[Sat Apr 25 18:37:57.108679 2026] [:error] [pid 29049:tid 29071] [client 4.235.0.161:45154] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/gettest.php"] [unique_id "aeyZhSfsWHIvmg63qcVhBgAAARQ"]
[Sat Apr 25 18:37:57.820051 2026] [:error] [pid 16195:tid 16211] [client 4.235.0.161:18790] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "aeyZhTVPLvrpvXaNQOkTkgAAAA0"]
[Sat Apr 25 18:37:58.554466 2026] [:error] [pid 16106:tid 16118] [client 4.235.0.161:45179] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "aeyZhiGjdEsrWF7e-7MejAAAAEg"]
[Sat Apr 25 18:37:59.571509 2026] [:error] [pid 16195:tid 16198] [client 4.235.0.161:13279] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "aeyZhzVPLvrpvXaNQOkTmAAAAAA"]
[Sat Apr 25 18:38:00.249582 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:11406] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/acp.php"] [unique_id "aeyZiCfsWHIvmg63qcVhEAAAARc"]
[Sat Apr 25 18:38:00.931281 2026] [:error] [pid 16107:tid 16156] [client 4.235.0.161:51181] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file48.php"] [unique_id "aeyZiNIfF7Hy3tw0sYRnGwAAAJM"]
[Sat Apr 25 18:38:01.625006 2026] [:error] [pid 29049:tid 29072] [client 4.235.0.161:10861] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file48.php"] [unique_id "aeyZiSfsWHIvmg63qcVhFAAAARU"]
[Sat Apr 25 18:38:02.269571 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:44493] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file48.php"] [unique_id "aeyZiifsWHIvmg63qcVhFgAAARc"]
[Sat Apr 25 18:38:02.981909 2026] [:error] [pid 29049:tid 29065] [client 4.235.0.161:51138] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file48.php"] [unique_id "aeyZiifsWHIvmg63qcVhHAAAAQ4"]
[Sat Apr 25 18:38:03.631565 2026] [:error] [pid 16108:tid 16165] [client 4.235.0.161:2987] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZi4bPF4HSQDj6Wrli0QAAAME"]
[Sat Apr 25 18:38:04.376967 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:46879] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZjCfsWHIvmg63qcVhIQAAARc"]
[Sat Apr 25 18:38:05.143609 2026] [:error] [pid 16106:tid 16117] [client 4.235.0.161:18814] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZjSGjdEsrWF7e-7MekAAAAEc"]
[Sat Apr 25 18:38:05.773746 2026] [:error] [pid 16195:tid 16208] [client 4.235.0.161:44511] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/"] [unique_id "aeyZjTVPLvrpvXaNQOkTmQAAAAo"]
[Sat Apr 25 18:38:06.364515 2026] [:error] [pid 16108:tid 16187] [client 4.235.0.161:24862] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aeyZjobPF4HSQDj6Wrli1AAAANU"]
[Sat Apr 25 18:38:07.121150 2026] [:error] [pid 16106:tid 16111] [client 4.235.0.161:7888] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aeyZjyGjdEsrWF7e-7MelwAAAEE"]
[Sat Apr 25 18:38:07.821386 2026] [:error] [pid 29049:tid 29066] [client 4.235.0.161:7874] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aeyZjyfsWHIvmg63qcVhKgAAAQ8"]
[Sat Apr 25 18:38:08.414326 2026] [:error] [pid 29049:tid 29067] [client 4.235.0.161:10859] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/simple.php"] [unique_id "aeyZkCfsWHIvmg63qcVhLQAAARA"]
[Sat Apr 25 18:38:09.075359 2026] [:error] [pid 16106:tid 16115] [client 4.235.0.161:43839] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aeyZkSGjdEsrWF7e-7MemAAAAEU"]
[Sat Apr 25 18:38:09.683556 2026] [:error] [pid 16106:tid 16121] [client 4.235.0.161:13628] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aeyZkSGjdEsrWF7e-7MemwAAAEs"]
[Sat Apr 25 18:38:10.332335 2026] [:error] [pid 16106:tid 16131] [client 4.235.0.161:13615] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aeyZkiGjdEsrWF7e-7MenwAAAFU"]
[Sat Apr 25 18:38:11.008204 2026] [:error] [pid 16195:tid 16202] [client 4.235.0.161:24867] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/drykl.php"] [unique_id "aeyZkzVPLvrpvXaNQOkTngAAAAQ"]
[Sat Apr 25 18:38:11.580228 2026] [:error] [pid 16106:tid 16127] [client 4.235.0.161:8524] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aeyZkyGjdEsrWF7e-7MepgAAAFE"]
[Sat Apr 25 18:38:12.105854 2026] [:error] [pid 16195:tid 16207] [client 4.235.0.161:45169] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aeyZlDVPLvrpvXaNQOkToQAAAAk"]
[Sat Apr 25 18:38:12.649313 2026] [:error] [pid 29049:tid 29072] [client 4.235.0.161:45124] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aeyZlCfsWHIvmg63qcVhNAAAARU"]
[Sat Apr 25 18:38:13.212314 2026] [:error] [pid 29049:tid 29058] [client 4.235.0.161:11453] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xxx.php"] [unique_id "aeyZlSfsWHIvmg63qcVhOwAAAQc"]
[Sat Apr 25 18:38:13.767230 2026] [:error] [pid 29049:tid 29057] [client 4.235.0.161:12590] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hypo.php"] [unique_id "aeyZlSfsWHIvmg63qcVhPQAAAQY"]
[Sat Apr 25 18:38:14.330184 2026] [:error] [pid 29049:tid 29064] [client 4.235.0.161:13283] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hypo.php"] [unique_id "aeyZlifsWHIvmg63qcVhRAAAAQ0"]
[Sat Apr 25 18:38:14.874266 2026] [:error] [pid 29049:tid 29056] [client 4.235.0.161:46869] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hypo.php"] [unique_id "aeyZlifsWHIvmg63qcVhSQAAAQU"]
[Sat Apr 25 18:38:15.417677 2026] [:error] [pid 16106:tid 16113] [client 4.235.0.161:11409] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/hypo.php"] [unique_id "aeyZlyGjdEsrWF7e-7MeqwAAAEM"]
[Sat Apr 25 18:38:16.034709 2026] [:error] [pid 16106:tid 16129] [client 4.235.0.161:9674] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aeyZmCGjdEsrWF7e-7MerQAAAFM"]
[Sat Apr 25 18:38:16.690318 2026] [:error] [pid 16195:tid 16217] [client 4.235.0.161:18813] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aeyZmDVPLvrpvXaNQOkTpgAAABM"]
[Sat Apr 25 18:38:17.251154 2026] [:error] [pid 16106:tid 16126] [client 4.235.0.161:62447] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aeyZmSGjdEsrWF7e-7MerwAAAFA"]
[Sat Apr 25 18:38:17.874881 2026] [:error] [pid 16106:tid 16122] [client 4.235.0.161:8537] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file18.php"] [unique_id "aeyZmSGjdEsrWF7e-7MesQAAAEw"]
[Sat Apr 25 18:38:18.414564 2026] [:error] [pid 16106:tid 16123] [client 4.235.0.161:55625] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "aeyZmiGjdEsrWF7e-7MetAAAAE0"]
[Sat Apr 25 18:38:18.989842 2026] [:error] [pid 16108:tid 16180] [client 4.235.0.161:57344] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "aeyZmobPF4HSQDj6Wrli1wAAAM4"]
[Sat Apr 25 18:38:19.619576 2026] [:error] [pid 29049:tid 29074] [client 4.235.0.161:2256] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "aeyZmyfsWHIvmg63qcVhUgAAARc"]
[Sat Apr 25 18:38:20.211137 2026] [:error] [pid 16107:tid 16151] [client 4.235.0.161:18753] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/xwx1.php"] [unique_id "aeyZnNIfF7Hy3tw0sYRnIwAAAI4"]
[Sat Apr 25 18:38:20.796178 2026] [:error] [pid 16107:tid 16159] [client 4.235.0.161:18808] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeyZnNIfF7Hy3tw0sYRnJQAAAJY"]
[Sat Apr 25 18:38:21.317851 2026] [:error] [pid 29049:tid 29072] [client 4.235.0.161:57350] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeyZnSfsWHIvmg63qcVhWAAAARU"]
[Sat Apr 25 18:38:21.891721 2026] [:error] [pid 29049:tid 29061] [client 4.235.0.161:13266] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeyZnSfsWHIvmg63qcVhWgAAAQo"]
[Sat Apr 25 18:38:22.441986 2026] [:error] [pid 16106:tid 16113] [client 4.235.0.161:13286] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeyZniGjdEsrWF7e-7MevgAAAEM"]
[Sat Apr 25 18:38:22.864693 2026] [:error] [pid 16107:tid 16150] [client 4.235.0.161:11450] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeyZntIfF7Hy3tw0sYRnJgAAAI0"]
[Sat Apr 25 18:38:23.027126 2026] [:error] [pid 16107:tid 16145] [client 4.235.0.161:8019] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aeyZn9IfF7Hy3tw0sYRnJwAAAIg"]
[Sat Apr 25 18:38:23.593427 2026] [:error] [pid 16106:tid 16133] [client 4.235.0.161:13264] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeyZnyGjdEsrWF7e-7MewQAAAFc"]
[Sat Apr 25 18:38:23.633063 2026] [:error] [pid 16195:tid 16219] [client 4.235.0.161:11429] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aeyZnzVPLvrpvXaNQOkTsQAAABU"]
[Sat Apr 25 18:38:24.190267 2026] [:error] [pid 29049:tid 29058] [client 4.235.0.161:57400] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aeyZoCfsWHIvmg63qcVhXQAAAQc"]
[Sat Apr 25 18:38:24.522106 2026] [:error] [pid 16106:tid 16125] [client 4.235.0.161:9680] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeyZoCGjdEsrWF7e-7MexAAAAE8"]
[Sat Apr 25 18:38:24.713768 2026] [:error] [pid 16107:tid 16143] [client 4.235.0.161:34372] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/chosen.php"] [unique_id "aeyZoNIfF7Hy3tw0sYRnKAAAAIY"]
[Sat Apr 25 18:38:25.627641 2026] [:error] [pid 29049:tid 29056] [client 4.235.0.161:8008] [client 4.235.0.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeyZoSfsWHIvmg63qcVhYQAAAQU"]
[Sat Apr 25 23:21:52.844075 2026] [:error] [pid 3212:tid 3238] [client 162.62.213.187:39500] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aezcEPg-28TY8_YLtUdx3gAAARg"]
[Sun Apr 26 02:31:20.331612 2026] [:error] [pid 3212:tid 3234] [client 182.42.104.32:60266] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae0IePg-28TY8_YLtUfhzgAAARQ"]
[Sun Apr 26 03:28:52.776085 2026] [:error] [pid 59985:tid 59993] [client 43.153.71.132:45596] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae0V9AF_zDvEhKvyTH4rYgAAAAY"]
[Sun Apr 26 05:28:08.376462 2026] [:error] [pid 41906:tid 41927] [client 212.8.249.216:21222] [client 212.8.249.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.8.249.216, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ae0x6D3-0A3lxw9OXoD5cwAAAZM"]
[Sun Apr 26 05:45:51.098079 2026] [:error] [pid 31273:tid 31361] [client 94.26.106.29:54860] [client 94.26.106.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.29, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae02D_hcNJEGrATcuEfA8gAAAVY"], referer: https://duckduckgo.com/
[Sun Apr 26 05:45:58.984444 2026] [:error] [pid 31273:tid 31363] [client 94.26.106.29:54860] [client 94.26.106.29] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paramountestate.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae02FvhcNJEGrATcuEfBDQAAAVg"], referer: https://www.bing.com/
[Sun Apr 26 05:45:59.561024 2026] [:error] [pid 31273:tid 31359] [client 94.26.106.29:54860] [client 94.26.106.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.29, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae02F_hcNJEGrATcuEfBDgAAAVQ"], referer: https://paramountestate.com/wp-login.php
[Sun Apr 26 05:46:06.477426 2026] [:error] [pid 31273:tid 31355] [client 94.26.106.29:54860] [client 94.26.106.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.29, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae02HvhcNJEGrATcuEfBHQAAAVA"], referer: https://paramountestate.com/wp-login.php
[Sun Apr 26 05:46:16.156979 2026] [:error] [pid 31273:tid 31346] [client 94.26.106.29:54860] [client 94.26.106.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.29, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae02KPhcNJEGrATcuEfBUwAAAUg"], referer: https://paramountestate.com/wp-login.php
[Sun Apr 26 05:58:18.825699 2026] [:error] [pid 8491:tid 8513] [client 206.81.6.43:64491] [client 206.81.6.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.6.43, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae04-iq7I7e6CJooQM2SwQAAAM4"]
[Sun Apr 26 05:58:19.742349 2026] [:error] [pid 8390:tid 8475] [client 206.81.6.43:60207] [client 206.81.6.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.6.43, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae04-4GPtFK_i9p5yxQVwwAAAJg"]
[Sun Apr 26 08:36:48.406835 2026] [:error] [pid 8390:tid 8456] [client 212.47.78.129:55203] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae1eIIGPtFK_i9p5yxRELwAAAIU"]
[Sun Apr 26 08:36:48.997919 2026] [:error] [pid 16574:tid 16606] [client 212.47.78.129:55019] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae1eIH5MsX8wRQr99nYCawAAA0I"]
[Sun Apr 26 08:36:49.579883 2026] [:error] [pid 13197:tid 13246] [client 212.47.78.129:54451] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "ae1eId3kktFKdSxTrBuaKwAAAs4"]
[Sun Apr 26 09:05:14.343451 2026] [:error] [pid 8390:tid 8474] [client 43.140.247.223:36094] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ae1kyoGPtFK_i9p5yxRTPgAAAJc"]
[Sun Apr 26 10:51:20.530148 2026] [autoindex:error] [pid 8491:tid 8504] [client 20.78.174.75:9779] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 10:51:22.423674 2026] [:error] [pid 8491:tid 8516] [client 20.78.174.75:9779] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "ae19qiq7I7e6CJooQM3IvAAAANE"]
[Sun Apr 26 10:51:24.837909 2026] [:error] [pid 16574:tid 16611] [client 20.78.174.75:9742] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "ae19rH5MsX8wRQr99nYQlQAAA0c"]
[Sun Apr 26 10:51:25.320935 2026] [:error] [pid 13137:tid 13153] [client 20.78.174.75:9248] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "ae19rd0RB4J0o4h5neEYhgAAAgw"]
[Sun Apr 26 10:51:25.814796 2026] [:error] [pid 8385:tid 8435] [client 20.78.174.75:9744] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "ae19rTOy7_J84Wx3-oyTdAAAAEs"]
[Sun Apr 26 13:46:26.380050 2026] [:error] [pid 13137:tid 13158] [client 172.71.172.60:11560] [client 172.71.172.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "ae2mst0RB4J0o4h5neE2egAAAhE"]
[Sun Apr 26 14:41:26.458389 2026] [:error] [pid 8390:tid 8470] [client 20.9.69.97:12068] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ae2zloGPtFK_i9p5yxTt_gAAAJM"]
[Sun Apr 26 14:42:09.965163 2026] [:error] [pid 8390:tid 8472] [client 20.9.69.97:11819] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "ae2zwYGPtFK_i9p5yxTuWgAAAJU"]
[Sun Apr 26 14:42:11.494937 2026] [:error] [pid 13137:tid 13163] [client 20.9.69.97:12038] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "ae2zw90RB4J0o4h5neFAPgAAAhY"]
[Sun Apr 26 14:42:13.762086 2026] [:error] [pid 8390:tid 8466] [client 20.9.69.97:11785] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "ae2zxYGPtFK_i9p5yxTuZAAAAI8"]
[Sun Apr 26 14:42:15.199084 2026] [:error] [pid 13137:tid 13152] [client 20.9.69.97:11834] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "ae2zx90RB4J0o4h5neFARAAAAgs"]
[Sun Apr 26 14:42:18.385000 2026] [proxy_fcgi:error] [pid 22573:tid 22618] [client 20.9.69.97:11814] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 14:42:22.215581 2026] [:error] [pid 22573:tid 22611] [client 20.9.69.97:11814] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "ae2zznB3EmQlD4yKUt-ubAAAAYU"]
[Sun Apr 26 14:47:19.407537 2026] [:error] [pid 13137:tid 13142] [client 20.9.69.97:12000] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "ae20990RB4J0o4h5neFBUwAAAgI"]
[Sun Apr 26 15:15:37.951635 2026] [ssl:error] [pid 8491:tid 8499] [client 163.172.74.34:39478] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com provided via HTTP have no compatible SSL setup
[Sun Apr 26 15:42:34.318178 2026] [:error] [pid 22573:tid 22607] [client 45.131.195.106:39545] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae3B6nB3EmQlD4yKUt-87QAAAYE"]
[Sun Apr 26 15:49:05.275906 2026] [:error] [pid 22572:tid 22587] [client 43.157.175.122:39020] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ae3DcdXOViWCFU-pZzDzAAAAAUk"]
[Sun Apr 26 15:51:26.513726 2026] [:error] [pid 13137:tid 13146] [client 117.62.235.53:52166] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae3D_t0RB4J0o4h5neFK3AAAAgY"]
[Sun Apr 26 16:44:20.810880 2026] [:error] [pid 8383:tid 8421] [client 52.225.25.97:45291] [client 52.225.25.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.225.25.97, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/wp/xmlrpc.php"] [unique_id "ae3QZNFa2S3EsATMdWMLugAAABg"]
[Sun Apr 26 22:48:05.113837 2026] [:error] [pid 13197:tid 13235] [client 20.89.243.55:3242] [client 20.89.243.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.89.243.55, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae4lpd3kktFKdSxTrBvklwAAAsQ"]
[Sun Apr 26 22:48:06.244640 2026] [:error] [pid 13197:tid 13232] [client 20.89.243.55:3242] [client 20.89.243.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.89.243.55, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ae4lpt3kktFKdSxTrBvkoAAAAsE"]
[Sun Apr 26 22:48:07.761929 2026] [:error] [pid 13197:tid 13244] [client 20.89.243.55:3242] [client 20.89.243.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ae4lp93kktFKdSxTrBvkrAAAAsw"]
[Mon Apr 27 02:14:08.753550 2026] [:error] [pid 13137:tid 13144] [client 102.208.148.69:49583] [client 102.208.148.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.148.69, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ae5V8N0RB4J0o4h5neHPHQAAAgQ"]
[Mon Apr 27 05:10:51.654360 2026] [:error] [pid 22646:tid 22696] [client 43.153.36.110:40138] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ae5_W4k_HyZhTP6AYad6egAAAE0"]
[Mon Apr 27 05:29:54.492616 2026] [:error] [pid 22751:tid 22763] [client 14.215.163.132:58634] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae6D0ic0tCpVyVdFok-YjwAAAMk"]
[Mon Apr 27 07:38:58.226399 2026] [proxy_fcgi:error] [pid 36490:tid 36555] [client 20.89.243.55:3292] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 07:39:08.206555 2026] [:error] [pid 36490:tid 36563] [client 20.89.243.55:3292] [client 20.89.243.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.89.243.55, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/images/wp-login.php"] [unique_id "ae6iHExiWa1s9LPhuWK3qwAAAI8"]
[Mon Apr 27 11:49:03.754827 2026] [:error] [pid 55967:tid 55980] [client 223.244.35.77:54518] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ae7cr5qILaJi17iamABq3gAAAAs"]
[Mon Apr 27 13:51:52.014617 2026] [:error] [pid 62511:tid 62587] [client 34.55.86.97:57549] [client 34.55.86.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/media/system/js/core.js"] [unique_id "ae75eLBjE-jhU4FY4HhzYgAAAU0"]
[Mon Apr 27 16:17:27.601781 2026] [:error] [pid 41010:tid 41053] [client 170.106.110.146:49478] [client 170.106.110.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae8blzc-oOrM_e97_4D2BQAAAcs"]
[Mon Apr 27 18:21:10.702729 2026] [:error] [pid 61339:tid 61355] [client 36.41.75.167:56412] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae84liHHVuv2RN6lIrhfAgAAAE4"]
[Mon Apr 27 21:06:45.277992 2026] [:error] [pid 13464:tid 13491] [client 52.172.142.96:1041] [client 52.172.142.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.172.142.96, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae9fZWIEa0q6oQ95zvEkAAAAAdc"]
[Mon Apr 27 21:06:47.879274 2026] [:error] [pid 13464:tid 13481] [client 52.172.142.96:1041] [client 52.172.142.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ae9fZ2IEa0q6oQ95zvEkEQAAAc0"]
[Mon Apr 27 21:06:51.055284 2026] [:error] [pid 13554:tid 13576] [client 52.172.142.96:1034] [client 52.172.142.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "ae9fa3Jx87Dl-xMmL92BkwAAANQ"]
[Mon Apr 27 21:06:52.229208 2026] [:error] [pid 13523:tid 13539] [client 52.172.142.96:14656] [client 52.172.142.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ae9fbOeav51IXKv1ebH0XAAAAI4"]
[Mon Apr 27 21:06:54.073727 2026] [:error] [pid 13554:tid 13573] [client 52.172.142.96:1415] [client 52.172.142.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "ae9fbnJx87Dl-xMmL92BpQAAANE"]
[Mon Apr 27 22:42:33.476797 2026] [:error] [pid 31555:tid 31581] [client 43.156.109.53:40536] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae912bJDZf3DNaSMAJ1uTQAAABg"]
[Tue Apr 28 01:56:37.120314 2026] [:error] [pid 36747:tid 36751] [client 43.153.71.132:42476] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ae-jVc9QpT00aPhkIcdkpQAAAYI"]
[Tue Apr 28 02:47:05.202893 2026] [:error] [pid 13554:tid 13557] [client 20.78.158.176:9574] [client 20.78.158.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.78.158.176, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae-vKXJx87Dl-xMmL93vPwAAAME"]
[Tue Apr 28 02:47:07.341733 2026] [:error] [pid 13554:tid 13570] [client 20.78.158.176:9574] [client 20.78.158.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ae-vK3Jx87Dl-xMmL93vVQAAAM4"]
[Tue Apr 28 02:47:08.842807 2026] [:error] [pid 42612:tid 42765] [client 20.78.158.176:15317] [client 20.78.158.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "ae-vLDCDyZvIG2oFcJ7nfQAAAQg"]
[Tue Apr 28 02:47:09.916050 2026] [:error] [pid 13464:tid 13472] [client 20.78.158.176:15318] [client 20.78.158.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ae-vLWIEa0q6oQ95zvFVOQAAAcQ"]
[Tue Apr 28 02:47:11.391961 2026] [:error] [pid 13465:tid 13498] [client 20.78.158.176:15694] [client 20.78.158.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "ae-vL_19I-6GBJQxn_gGdgAAAEM"]
[Tue Apr 28 05:39:09.603888 2026] [:error] [pid 14579:tid 14644] [client 43.154.127.188:43714] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ae_XfRrUiOG83qKKuuDrIgAAAIQ"]
[Tue Apr 28 07:41:46.692577 2026] [:error] [pid 33864:tid 33888] [client 51.103.73.149:15952] [client 51.103.73.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.103.73.149, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ae_0OjXchLGZ4QggCsmAugAAAJY"]
[Tue Apr 28 07:41:50.364284 2026] [:error] [pid 33864:tid 33887] [client 51.103.73.149:15952] [client 51.103.73.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.103.73.149, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ae_0PjXchLGZ4QggCsmA3wAAAJU"]
[Tue Apr 28 07:41:53.248086 2026] [:error] [pid 33864:tid 33875] [client 51.103.73.149:15952] [client 51.103.73.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ae_0QTXchLGZ4QggCsmA-AAAAIk"]
[Tue Apr 28 14:04:03.469601 2026] [:error] [pid 50889:tid 50907] [client 221.229.106.25:44350] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afBN04zszBr00txEzGj17AAAAA8"]
[Tue Apr 28 16:16:23.799947 2026] [:error] [pid 33864:tid 33875] [client 43.133.253.253:57938] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afBs1zXchLGZ4QggCsn3PQAAAIk"]
[Tue Apr 28 17:53:13.661803 2026] [:error] [pid 2741:tid 2760] [client 45.215.251.199:5116] [client 45.215.251.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.215.251.199, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afCDifp92FeOz1h6ILzLKQAAAU4"]
[Tue Apr 28 19:27:32.345861 2026] [:error] [pid 33776:tid 33832] [client 43.157.43.147:33996] [client 43.157.43.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afCZpF-bEJ2CKP3iKAAqXgAAAFg"]
[Tue Apr 28 20:57:40.197416 2026] [:error] [pid 33777:tid 33843] [client 20.220.234.220:22063] [client 20.220.234.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.234.220, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "afCuxLXUCFWqmordGGLthwAAAQg"]
[Tue Apr 28 20:59:48.006780 2026] [:error] [pid 33775:tid 33803] [client 20.220.234.220:22040] [client 20.220.234.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.220.234.220, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afCvRJsYOcoQrq88YbUxsgAAANg"]
[Tue Apr 28 21:00:40.770177 2026] [:error] [pid 33777:tid 33847] [client 20.220.234.220:22022] [client 20.220.234.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "afCveLXUCFWqmordGGLu6AAAAQw"]
[Tue Apr 28 21:07:41.954581 2026] [:error] [pid 50889:tid 50908] [client 20.220.234.220:22049] [client 20.220.234.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/test1.php"] [unique_id "afCxHYzszBr00txEzGhP4wAAABA"]
[Tue Apr 28 21:07:45.865103 2026] [:error] [pid 50889:tid 50913] [client 20.220.234.220:22615] [client 20.220.234.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "afCxIYzszBr00txEzGhP5QAAABU"]
[Tue Apr 28 22:28:31.380169 2026] [:error] [pid 2741:tid 2760] [client 43.134.35.91:46318] [client 43.134.35.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afDED_p92FeOz1h6ILwWWAAAAU4"]
[Wed Apr 29 01:55:25.935098 2026] [:error] [pid 33776:tid 33832] [client 43.130.139.177:49920] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afD0jV-bEJ2CKP3iKABg5wAAAFg"]
[Wed Apr 29 03:22:49.125362 2026] [:error] [pid 35342:tid 35349] [client 121.229.185.160:60909] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afEJCe7D5-OXGLQYxO4IuAAAAwU"]
[Wed Apr 29 09:34:41.459126 2026] [:error] [pid 31659:tid 31694] [client 49.51.196.42:48026] [client 49.51.196.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afFgMTQBXUGnVedgUSK72QAAAIQ"]
[Wed Apr 29 10:29:03.337713 2026] [:error] [pid 61539:tid 61549] [client 34.35.117.84:55102] [client 34.35.117.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "afFs713XmLvOLqFtXVEjZQAAAAY"]
[Wed Apr 29 10:33:39.891832 2026] [:error] [pid 61540:tid 61586] [client 20.12.211.211:9346] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wk/index.php"] [unique_id "afFuA-Q8cJB7pQslzIea5AAAAI0"]
[Wed Apr 29 10:33:41.323334 2026] [:error] [pid 61541:tid 61622] [client 20.12.211.211:9418] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wk/index.php"] [unique_id "afFuBVoqNK1GZvjPpy5WaAAAAhY"]
[Wed Apr 29 10:33:50.941755 2026] [:error] [pid 61541:tid 61601] [client 20.12.211.211:9362] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wk/index.php"] [unique_id "afFuDloqNK1GZvjPpy5WcQAAAgE"]
[Wed Apr 29 10:33:52.619861 2026] [:error] [pid 61540:tid 61579] [client 20.12.211.211:9663] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wk/index.php"] [unique_id "afFuEOQ8cJB7pQslzIea7QAAAIY"]
[Wed Apr 29 14:58:31.234723 2026] [:error] [pid 45054:tid 45071] [client 43.130.91.95:42486] [client 43.130.91.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afGsF4tL6SUL31r23c-bzQAAAo8"]
[Wed Apr 29 15:26:26.885689 2026] [:error] [pid 45054:tid 45056] [client 45.119.85.39:62405] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp/wp-login.php"] [unique_id "afGyootL6SUL31r23c-hSwAAAoA"], referer: https://www.google.com
[Wed Apr 29 15:26:26.885760 2026] [:error] [pid 45054:tid 45056] [client 45.119.85.39:62405] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 53"] [hostname "paramountestate.com"] [uri "/wp/wp-login.php"] [unique_id "afGyootL6SUL31r23c-hSwAAAoA"], referer: https://www.google.com
[Wed Apr 29 15:46:23.479601 2026] [:error] [pid 61540:tid 61576] [client 45.119.85.39:59786] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wordpress/wp-login.php"] [unique_id "afG3T-Q8cJB7pQslzIfW-QAAAIM"], referer: https://www.google.com
[Wed Apr 29 15:46:23.479687 2026] [:error] [pid 61540:tid 61576] [client 45.119.85.39:59786] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 227"] [hostname "paramountestate.com"] [uri "/wordpress/wp-login.php"] [unique_id "afG3T-Q8cJB7pQslzIfW-QAAAIM"], referer: https://www.google.com
[Wed Apr 29 17:16:43.265191 2026] [:error] [pid 45085:tid 45097] [client 43.166.244.251:33870] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afHMe9S7eNjgd8gD6ZwFnAAAAso"]
[Wed Apr 29 19:39:48.121639 2026] [:error] [pid 2604:tid 2610] [client 43.157.43.147:55740] [client 43.157.43.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afHuBBx5WQMU1W68tTY3QwAAAEQ"]
[Wed Apr 29 19:56:46.082503 2026] [:error] [pid 21136:tid 21159] [client 45.94.31.132:55536] [client 45.94.31.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.94.31.132, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afHx_ilIfGGQdPVv8_Pe_gAAAFI"]
[Wed Apr 29 19:56:49.356248 2026] [:error] [pid 21136:tid 21145] [client 45.94.31.132:55536] [client 45.94.31.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.94.31.132, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afHyASlIfGGQdPVv8_PfBgAAAEQ"]
[Wed Apr 29 21:59:26.765308 2026] [:error] [pid 21137:tid 21184] [client 43.167.232.38:45890] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afIOvvw-HnaioFPIurVm2gAAAA8"]
[Thu Apr 30 00:31:40.371426 2026] [:error] [pid 21138:tid 21197] [client 119.28.89.249:38710] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afIybJuzwUiyMeUnp30fnQAAAQE"]
[Thu Apr 30 00:58:10.585145 2026] [:error] [pid 47618:tid 47626] [client 175.27.163.171:53482] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afI4onHYUSxIrhce2OBEWgAAAUU"]
[Thu Apr 30 03:53:15.503092 2026] [:error] [pid 18113:tid 18187] [client 43.157.38.131:36218] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afJhq3iIjwsVGkvz5IlEfAAAAIo"]
[Thu Apr 30 04:28:32.994519 2026] [:error] [pid 18111:tid 18122] [client 150.242.87.50:1278] [client 150.242.87.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.242.87.50, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afJp8GctLbxB7Q1_oK141wAAAAA"]
[Thu Apr 30 10:23:05.341069 2026] [:error] [pid 53641:tid 53675] [client 43.161.217.205:40216] [client 43.161.217.205] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afK9CWC119wja3QGeAGSawAAAZc"]
[Thu Apr 30 13:43:28.771618 2026] [:error] [pid 52350:tid 52358] [client 43.130.141.193:49486] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afLsAP1j4GHE9hm7bfeE_QAAAQE"]
[Thu Apr 30 16:40:59.104595 2026] [:error] [pid 39912:tid 39976] [client 43.153.119.119:35672] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afMVm68-s8fTICYp_ct7tQAAAIU"]
[Thu Apr 30 19:15:07.986100 2026] [:error] [pid 5733:tid 5795] [client 43.130.40.120:52498] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afM5u_T55_Ioa9J2OpLgfwAAAQU"]
[Thu Apr 30 21:37:30.269179 2026] [:error] [pid 5732:tid 5781] [client 216.81.248.149:39358] [client 216.81.248.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "afNbGtuJ3iSd5GdjqlhJIAAAANI"]
[Thu Apr 30 21:58:28.439425 2026] [:error] [pid 5820:tid 5841] [client 80.241.213.248:64997] [client 80.241.213.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/"] [unique_id "afNgBAyrLh3-LgH3Xv9djwAAABM"], referer: binance.com
[Fri May 01 00:37:03.737137 2026] [:error] [pid 5731:tid 5749] [client 49.51.183.75:45344] [client 49.51.183.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afOFLw8tX7TbSfYoUIxYRwAAAI4"]
[Fri May 01 01:06:48.426407 2026] [:error] [pid 5733:tid 5792] [client 49.235.136.28:55276] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afOMKPT55_Ioa9J2OpIUEwAAAQI"]
[Fri May 01 03:50:17.030743 2026] [:error] [pid 11850:tid 11854] [client 43.135.115.233:56084] [client 43.135.115.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afOyeS9FWNKz5NLi2PRpDwAAAAA"]
[Fri May 01 04:56:40.334246 2026] [:error] [pid 38015:tid 38055] [client 92.53.64.155:58560] [client 92.53.64.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "afPCCMNJWoh41gYMCSVpQwAAAEQ"]
[Fri May 01 06:53:13.717499 2026] [:error] [pid 38014:tid 38037] [client 43.164.190.28:43022] [client 43.164.190.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afPdWVHplhcdzdndjk0NogAAAA4"]
[Fri May 01 07:31:00.472597 2026] [:error] [pid 6046:tid 6095] [client 34.174.67.188:33262] [client 34.174.67.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "afPmNIyBrpmb1HMIbiTypgAAAYs"]
[Fri May 01 09:57:06.527674 2026] [:error] [pid 38015:tid 38058] [client 43.159.149.216:43758] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afQIcsNJWoh41gYMCSWwMwAAAEc"]
[Fri May 01 12:28:01.555211 2026] [:error] [pid 25085:tid 25099] [client 43.138.68.113:33636] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afQr0fuD8fWRiE0RX0GTdgAAAUg"]
[Fri May 01 12:42:49.529762 2026] [:error] [pid 24995:tid 24999] [client 43.157.98.187:49288] [client 43.157.98.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afQvSedJG9WB_Q_ne0toUgAAAEA"]
[Fri May 01 20:48:20.808000 2026] [:error] [pid 24996:tid 25053] [client 43.160.219.206:47976] [client 43.160.219.206] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afShFCDBq9mMfUWQQepl2QAAAJU"]
[Fri May 01 21:22:30.038266 2026] [:error] [pid 33791:tid 33818] [client 187.101.62.172:52766] [client 187.101.62.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.101.62.172, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afSpFm9ixd-moLycM9Ad-QAAABg"]
[Fri May 01 22:43:59.943276 2026] [:error] [pid 25085:tid 25108] [client 20.166.9.204:4782] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "afS8L_uD8fWRiE0RX0EXwAAAAVE"]
[Fri May 01 22:44:08.718667 2026] [:error] [pid 25085:tid 25092] [client 20.166.9.204:8145] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "afS8OPuD8fWRiE0RX0EX3AAAAUE"]
[Fri May 01 22:44:10.302871 2026] [:error] [pid 25085:tid 25096] [client 20.166.9.204:8145] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "afS8OvuD8fWRiE0RX0EX4AAAAUU"]
[Fri May 01 22:44:12.065689 2026] [:error] [pid 25085:tid 25103] [client 20.166.9.204:10853] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "afS8PPuD8fWRiE0RX0EX4wAAAUw"]
[Fri May 01 22:44:13.123342 2026] [:error] [pid 33791:tid 33794] [client 20.166.9.204:12166] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "afS8PW9ixd-moLycM9A1AQAAAAA"]
[Fri May 01 22:44:15.671443 2026] [proxy_fcgi:error] [pid 33791:tid 33817] [client 20.166.9.204:12006] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:44:15.922643 2026] [:error] [pid 33791:tid 33813] [client 20.166.9.204:12006] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "afS8P29ixd-moLycM9A1EQAAABM"]
[Fri May 01 22:44:16.423416 2026] [:error] [pid 33791:tid 33811] [client 20.166.9.204:9063] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "afS8QG9ixd-moLycM9A1FAAAABE"]
[Fri May 01 22:44:20.321204 2026] [:error] [pid 33791:tid 33801] [client 20.166.9.204:2199] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afS8RG9ixd-moLycM9A1JQAAAAc"]
[Fri May 01 22:44:20.916613 2026] [:error] [pid 24997:tid 25046] [client 20.166.9.204:12210] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "afS8RPOkHa4ScY5oo8znUQAAAMA"]
[Fri May 01 22:44:22.104166 2026] [:error] [pid 25085:tid 25098] [client 20.166.9.204:10196] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/admin.php"] [unique_id "afS8RvuD8fWRiE0RX0EX9AAAAUc"]
[Fri May 01 22:44:27.884413 2026] [:error] [pid 24997:tid 25072] [client 20.166.9.204:11281] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "afS8S_OkHa4ScY5oo8znXwAAANA"]
[Fri May 01 22:44:32.368211 2026] [:error] [pid 25320:tid 25343] [client 20.166.9.204:2189] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "afS8UFc3wJ-3-XaXB3oh5QAAARQ"]
[Fri May 01 22:44:32.948489 2026] [:error] [pid 25320:tid 25331] [client 20.166.9.204:2189] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "afS8UFc3wJ-3-XaXB3oh5gAAAQg"]
[Fri May 01 22:44:34.807004 2026] [:error] [pid 25320:tid 25324] [client 20.166.9.204:11295] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "afS8Ulc3wJ-3-XaXB3oh6QAAAQE"]
[Fri May 01 22:44:35.447205 2026] [:error] [pid 25085:tid 25107] [client 20.166.9.204:6852] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/about.php"] [unique_id "afS8U_uD8fWRiE0RX0EYBQAAAVA"]
[Fri May 01 22:44:36.643750 2026] [:error] [pid 33791:tid 33809] [client 20.166.9.204:6869] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "afS8VG9ixd-moLycM9A1OgAAAA8"]
[Fri May 01 22:44:40.335221 2026] [:error] [pid 33791:tid 33814] [client 20.166.9.204:2193] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/about.php"] [unique_id "afS8WG9ixd-moLycM9A1QQAAABQ"]
[Fri May 01 22:44:42.983998 2026] [proxy_fcgi:error] [pid 33791:tid 33811] [client 20.166.9.204:3847] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:44:43.291585 2026] [:error] [pid 33791:tid 33795] [client 20.166.9.204:3847] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "afS8W29ixd-moLycM9A1TAAAAAE"]
[Fri May 01 22:44:44.999109 2026] [:error] [pid 25320:tid 25335] [client 20.166.9.204:8182] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/wp-login.php"] [unique_id "afS8XFc3wJ-3-XaXB3oh9AAAAQw"]
[Fri May 01 22:44:47.257866 2026] [:error] [pid 25320:tid 25337] [client 20.166.9.204:8182] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "afS8X1c3wJ-3-XaXB3oh_wAAAQ4"]
[Fri May 01 22:44:49.997523 2026] [:error] [pid 24996:tid 25044] [client 20.166.9.204:6853] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/plugins.php"] [unique_id "afS8YSDBq9mMfUWQQeqEnQAAAI8"]
[Fri May 01 22:45:00.351747 2026] [proxy_fcgi:error] [pid 24996:tid 25049] [client 20.166.9.204:1392] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:45:01.208248 2026] [proxy_fcgi:error] [pid 24996:tid 25031] [client 20.166.9.204:1392] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:45:01.475141 2026] [:error] [pid 24996:tid 25036] [client 20.166.9.204:1392] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "afS8bSDBq9mMfUWQQeqEtAAAAIg"]
[Fri May 01 22:45:02.637406 2026] [proxy_fcgi:error] [pid 25320:tid 25332] [client 20.166.9.204:6862] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:45:05.379121 2026] [:error] [pid 25320:tid 25323] [client 20.166.9.204:6862] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/plugins.php"] [unique_id "afS8cVc3wJ-3-XaXB3oiIAAAAQA"]
[Fri May 01 22:45:07.062839 2026] [:error] [pid 24995:tid 25017] [client 20.166.9.204:1351] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "afS8c-dJG9WB_Q_ne0vBdAAAAFI"]
[Fri May 01 22:45:08.133767 2026] [:error] [pid 25085:tid 25106] [client 20.166.9.204:12185] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "afS8dPuD8fWRiE0RX0EYCgAAAU8"]
[Fri May 01 22:45:12.146981 2026] [proxy_fcgi:error] [pid 25085:tid 25110] [client 20.166.9.204:12185] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:45:12.396256 2026] [:error] [pid 25085:tid 25107] [client 20.166.9.204:12185] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-login.php"] [unique_id "afS8ePuD8fWRiE0RX0EYEwAAAVA"]
[Fri May 01 22:45:12.896219 2026] [:error] [pid 25320:tid 25326] [client 20.166.9.204:4796] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "afS8eFc3wJ-3-XaXB3oiLgAAAQM"]
[Fri May 01 22:45:13.433354 2026] [proxy_fcgi:error] [pid 25320:tid 25337] [client 20.166.9.204:12183] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:45:16.062389 2026] [:error] [pid 25320:tid 25325] [client 20.166.9.204:12183] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bak.php"] [unique_id "afS8fFc3wJ-3-XaXB3oiOAAAAQI"]
[Fri May 01 22:45:19.540801 2026] [:error] [pid 25320:tid 25332] [client 20.166.9.204:1385] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "afS8f1c3wJ-3-XaXB3oiRAAAAQk"]
[Fri May 01 22:45:31.449951 2026] [:error] [pid 25320:tid 25344] [client 20.166.9.204:1385] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "afS8i1c3wJ-3-XaXB3oiYAAAARU"]
[Fri May 01 22:45:38.862333 2026] [:error] [pid 25320:tid 25330] [client 20.166.9.204:6878] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "afS8klc3wJ-3-XaXB3oicQAAAQc"]
[Fri May 01 22:45:41.108880 2026] [proxy_fcgi:error] [pid 24997:tid 25062] [client 20.166.9.204:8143] AH01071: Got error 'Primary script unknown'
[Fri May 01 22:45:47.759269 2026] [:error] [pid 24997:tid 25080] [client 20.166.9.204:8143] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "afS8m_OkHa4ScY5oo8znjAAAANg"]
[Fri May 01 22:45:49.982703 2026] [:error] [pid 24995:tid 25017] [client 20.166.9.204:12198] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "afS8nedJG9WB_Q_ne0vBjAAAAFI"]
[Fri May 01 22:45:53.914607 2026] [:error] [pid 33791:tid 33813] [client 20.166.9.204:9274] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "afS8oW9ixd-moLycM9A1nAAAABM"]
[Fri May 01 22:45:53.914672 2026] [:error] [pid 33791:tid 33813] [client 20.166.9.204:9274] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "afS8oW9ixd-moLycM9A1nAAAABM"]
[Fri May 01 22:45:54.503950 2026] [:error] [pid 24996:tid 25040] [client 20.166.9.204:4757] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-2019.php"] [unique_id "afS8oiDBq9mMfUWQQeqEyAAAAIw"]
[Fri May 01 22:45:55.074220 2026] [:error] [pid 24996:tid 25037] [client 20.166.9.204:4781] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/alfa.php"] [unique_id "afS8oyDBq9mMfUWQQeqEyQAAAIk"]
[Fri May 01 22:45:55.623862 2026] [:error] [pid 24996:tid 25055] [client 20.166.9.204:11274] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-content/themes/twenty/twenty.php"] [unique_id "afS8oyDBq9mMfUWQQeqEywAAAJY"]
[Fri May 01 22:45:56.124203 2026] [:error] [pid 50214:tid 50234] [client 20.166.9.204:11317] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "afS8pIs0pgrtfZkbhjN24gAAAZA"]
[Fri May 01 22:45:56.658131 2026] [:error] [pid 25320:tid 25347] [client 20.166.9.204:9220] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/abe.php"] [unique_id "afS8pFc3wJ-3-XaXB3oifAAAARg"]
[Fri May 01 22:45:57.234353 2026] [:error] [pid 24996:tid 25031] [client 20.166.9.204:9228] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/13.php"] [unique_id "afS8pSDBq9mMfUWQQeqEzgAAAIM"]
[Fri May 01 22:45:57.829700 2026] [:error] [pid 24996:tid 25041] [client 20.166.9.204:8128] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "afS8pSDBq9mMfUWQQeqEzwAAAI0"]
[Fri May 01 22:45:58.398775 2026] [:error] [pid 24997:tid 25074] [client 20.166.9.204:1378] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "afS8pvOkHa4ScY5oo8znjwAAANI"]
[Fri May 01 22:45:58.949164 2026] [:error] [pid 24997:tid 25046] [client 20.166.9.204:10187] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/sx.php"] [unique_id "afS8pvOkHa4ScY5oo8znkAAAAMA"]
[Fri May 01 22:45:59.482871 2026] [:error] [pid 25085:tid 25091] [client 20.166.9.204:4774] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-config-sample.php"] [unique_id "afS8p_uD8fWRiE0RX0EYIQAAAUA"]
[Fri May 01 22:46:00.016704 2026] [:error] [pid 24996:tid 25047] [client 20.166.9.204:10020] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/click.php"] [unique_id "afS8qCDBq9mMfUWQQeqE1QAAAJE"]
[Fri May 01 22:46:00.552326 2026] [:error] [pid 24996:tid 25030] [client 20.166.9.204:11311] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/install.php"] [unique_id "afS8qCDBq9mMfUWQQeqE1wAAAII"]
[Fri May 01 22:46:01.123430 2026] [:error] [pid 33791:tid 33805] [client 20.166.9.204:9076] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-content/403.php"] [unique_id "afS8qW9ixd-moLycM9A1ngAAAAs"]
[Fri May 01 22:46:01.719281 2026] [:error] [pid 33791:tid 33810] [client 20.166.9.204:11308] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-admin/includes/cloud.php"] [unique_id "afS8qW9ixd-moLycM9A1oAAAABA"]
[Fri May 01 22:46:02.360359 2026] [:error] [pid 50214:tid 50242] [client 20.166.9.204:8153] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/lv.php"] [unique_id "afS8qos0pgrtfZkbhjN25gAAAZc"]
[Fri May 01 22:46:02.973374 2026] [:error] [pid 25320:tid 25335] [client 20.166.9.204:6896] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-files.php"] [unique_id "afS8qlc3wJ-3-XaXB3oifwAAAQw"]
[Fri May 01 22:46:03.568719 2026] [:error] [pid 25320:tid 25341] [client 20.166.9.204:10038] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "afS8q1c3wJ-3-XaXB3oigAAAARI"]
[Fri May 01 22:46:04.121991 2026] [:error] [pid 24996:tid 25047] [client 20.166.9.204:9242] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/defaults.php"] [unique_id "afS8rCDBq9mMfUWQQeqE3AAAAJE"]
[Fri May 01 22:46:04.675476 2026] [:error] [pid 24996:tid 25045] [client 20.166.9.204:12201] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/aks.php"] [unique_id "afS8rCDBq9mMfUWQQeqE3QAAAJA"]
[Fri May 01 22:46:05.215515 2026] [:error] [pid 24995:tid 25014] [client 20.166.9.204:12207] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/index.php"] [unique_id "afS8redJG9WB_Q_ne0vBlwAAAE8"]
[Fri May 01 22:46:05.808435 2026] [:error] [pid 50214:tid 50234] [client 20.166.9.204:4737] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/admin"] [unique_id "afS8rYs0pgrtfZkbhjN26gAAAZA"]
[Fri May 01 22:46:06.399396 2026] [:error] [pid 25320:tid 25329] [client 20.166.9.204:6891] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "afS8rlc3wJ-3-XaXB3oiggAAAQY"]
[Fri May 01 22:46:06.949544 2026] [:error] [pid 25085:tid 25102] [client 20.166.9.204:12164] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 11"] [hostname "paramountestate.com"] [uri "/goat1.php"] [unique_id "afS8rvuD8fWRiE0RX0EYJAAAAUs"]
[Fri May 01 22:46:07.471218 2026] [:error] [pid 24996:tid 25041] [client 20.166.9.204:8129] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afS8ryDBq9mMfUWQQeqE4AAAAI0"]
[Fri May 01 22:46:07.471333 2026] [:error] [pid 24996:tid 25041] [client 20.166.9.204:8129] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afS8ryDBq9mMfUWQQeqE4AAAAI0"]
[Fri May 01 22:46:07.988314 2026] [:error] [pid 33791:tid 33798] [client 20.166.9.204:12186] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "afS8r29ixd-moLycM9A1ogAAAAQ"]
[Fri May 01 22:46:08.533935 2026] [:error] [pid 24997:tid 25060] [client 20.166.9.204:6887] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/inputs.php"] [unique_id "afS8sPOkHa4ScY5oo8znkwAAAMU"]
[Fri May 01 22:46:09.050270 2026] [:error] [pid 24996:tid 25047] [client 20.166.9.204:10818] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/admin.php"] [unique_id "afS8sSDBq9mMfUWQQeqE4gAAAJE"]
[Fri May 01 22:46:09.569164 2026] [:error] [pid 24995:tid 25006] [client 20.166.9.204:6868] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/randkeyword.PhP8"] [unique_id "afS8sedJG9WB_Q_ne0vBmAAAAEc"]
[Fri May 01 22:46:10.075093 2026] [:error] [pid 33791:tid 33803] [client 20.166.9.204:10195] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "afS8sm9ixd-moLycM9A1pAAAAAk"]
[Fri May 01 22:46:10.574463 2026] [:error] [pid 24997:tid 25080] [client 20.166.9.204:10835] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/admin.php"] [unique_id "afS8svOkHa4ScY5oo8znlAAAANg"]
[Fri May 01 22:46:11.073049 2026] [:error] [pid 50214:tid 50221] [client 20.166.9.204:9991] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/plugins.php"] [unique_id "afS8s4s0pgrtfZkbhjN27AAAAYM"]
[Fri May 01 22:46:11.605591 2026] [:error] [pid 24995:tid 25019] [client 20.166.9.204:10863] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/f.php"] [unique_id "afS8s-dJG9WB_Q_ne0vBmQAAAFQ"]
[Fri May 01 22:46:12.122768 2026] [:error] [pid 50214:tid 50222] [client 20.166.9.204:12181] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "afS8tIs0pgrtfZkbhjN27QAAAYQ"]
[Fri May 01 22:46:12.659833 2026] [:error] [pid 50214:tid 50236] [client 20.166.9.204:10843] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/shell.php"] [unique_id "afS8tIs0pgrtfZkbhjN27wAAAZI"]
[Fri May 01 22:46:13.211050 2026] [:error] [pid 33791:tid 33814] [client 20.166.9.204:9052] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/pki-validation/cloud.php"] [unique_id "afS8tW9ixd-moLycM9A1qAAAABQ"]
[Fri May 01 22:46:13.746147 2026] [:error] [pid 50214:tid 50237] [client 20.166.9.204:12188] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/style.php"] [unique_id "afS8tYs0pgrtfZkbhjN28gAAAZM"]
[Fri May 01 22:46:15.814432 2026] [:error] [pid 33791:tid 33798] [client 20.166.9.204:5509] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/css/cloud.php"] [unique_id "afS8t29ixd-moLycM9A1rAAAAAQ"]
[Fri May 01 22:46:16.322652 2026] [:error] [pid 24997:tid 25066] [client 20.166.9.204:1060] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/file.php"] [unique_id "afS8uPOkHa4ScY5oo8znngAAAMo"]
[Fri May 01 22:46:16.857665 2026] [:error] [pid 24996:tid 25043] [client 20.166.9.204:6711] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/atomlib.php"] [unique_id "afS8uCDBq9mMfUWQQeqE5QAAAI4"]
[Fri May 01 22:46:17.358492 2026] [:error] [pid 24996:tid 25059] [client 20.166.9.204:9315] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/alfa-rex.php7"] [unique_id "afS8uSDBq9mMfUWQQeqE5gAAAJg"]
[Fri May 01 22:46:17.893327 2026] [:error] [pid 24995:tid 25020] [client 20.166.9.204:9301] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/css/about.php"] [unique_id "afS8uedJG9WB_Q_ne0vBnAAAAFU"]
[Fri May 01 22:46:18.394370 2026] [:error] [pid 33791:tid 33814] [client 20.166.9.204:6713] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/setup-config.php"] [unique_id "afS8um9ixd-moLycM9A1tAAAABQ"]
[Fri May 01 22:46:18.893846 2026] [:error] [pid 33791:tid 33795] [client 20.166.9.204:12815] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "afS8um9ixd-moLycM9A1tgAAAAE"]
[Fri May 01 22:46:19.498716 2026] [:error] [pid 33791:tid 33805] [client 20.166.9.204:11788] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/class.php"] [unique_id "afS8u29ixd-moLycM9A1uAAAAAs"]
[Fri May 01 22:46:20.126278 2026] [:error] [pid 24995:tid 25021] [client 20.166.9.204:11816] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/network.php"] [unique_id "afS8vOdJG9WB_Q_ne0vBoAAAAFY"]
[Fri May 01 22:46:20.721755 2026] [:error] [pid 50214:tid 50221] [client 20.166.9.204:8066] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/ws.php"] [unique_id "afS8vIs0pgrtfZkbhjN29AAAAYM"]
[Fri May 01 22:46:21.276033 2026] [:error] [pid 50214:tid 50222] [client 20.166.9.204:14746] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/themes/zMousse/otuz1.php"] [unique_id "afS8vYs0pgrtfZkbhjN29QAAAYQ"]
[Fri May 01 22:46:21.775668 2026] [:error] [pid 24995:tid 25017] [client 20.166.9.204:15232] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "afS8vedJG9WB_Q_ne0vBoQAAAFI"]
[Fri May 01 22:46:22.327626 2026] [:error] [pid 24996:tid 25029] [client 20.166.9.204:4653] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/widgets.php"] [unique_id "afS8viDBq9mMfUWQQeqE6gAAAIE"]
[Fri May 01 22:46:22.828325 2026] [:error] [pid 24997:tid 25054] [client 20.166.9.204:15849] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "afS8vvOkHa4ScY5oo8znogAAAMM"]
[Fri May 01 22:46:23.378764 2026] [:error] [pid 33791:tid 33794] [client 20.166.9.204:9714] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/network.php"] [unique_id "afS8v29ixd-moLycM9A1uwAAAAA"]
[Fri May 01 22:46:23.934097 2026] [:error] [pid 33791:tid 33802] [client 20.166.9.204:9008] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/post.php"] [unique_id "afS8v29ixd-moLycM9A1vQAAAAg"]
[Fri May 01 22:46:24.483992 2026] [:error] [pid 50214:tid 50234] [client 20.166.9.204:15414] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/themes/pridmag/admin.php"] [unique_id "afS8wIs0pgrtfZkbhjN29wAAAZA"]
[Fri May 01 22:46:25.001518 2026] [:error] [pid 33791:tid 33817] [client 20.166.9.204:9723] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "afS8wW9ixd-moLycM9A1wAAAABc"]
[Fri May 01 22:46:25.516550 2026] [:error] [pid 50214:tid 50237] [client 20.166.9.204:9686] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/wp-login.php"] [unique_id "afS8wYs0pgrtfZkbhjN2-QAAAZM"]
[Fri May 01 22:46:26.068484 2026] [:error] [pid 25085:tid 25093] [client 20.166.9.204:14678] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-activate.php"] [unique_id "afS8wvuD8fWRiE0RX0EYLAAAAUI"]
[Fri May 01 22:46:26.618737 2026] [:error] [pid 24995:tid 25020] [client 20.166.9.204:6694] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "afS8wudJG9WB_Q_ne0vBpgAAAFU"]
[Fri May 01 22:46:27.130517 2026] [:error] [pid 24997:tid 25067] [client 20.166.9.204:16325] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "afS8w_OkHa4ScY5oo8znowAAAMs"]
[Fri May 01 22:46:27.649101 2026] [:error] [pid 24997:tid 25070] [client 20.166.9.204:1270] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "afS8w_OkHa4ScY5oo8znpQAAAM4"]
[Fri May 01 22:46:28.217461 2026] [:error] [pid 33791:tid 33810] [client 20.166.9.204:3197] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/install.php"] [unique_id "afS8xG9ixd-moLycM9A1wwAAABA"]
[Fri May 01 22:46:28.760801 2026] [:error] [pid 50214:tid 50226] [client 20.166.9.204:13556] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/default.php"] [unique_id "afS8xIs0pgrtfZkbhjN2-gAAAYg"]
[Fri May 01 22:46:29.302683 2026] [:error] [pid 25085:tid 25110] [client 20.166.9.204:7279] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/cong.php"] [unique_id "afS8xfuD8fWRiE0RX0EYMAAAAVM"]
[Fri May 01 22:46:29.802119 2026] [:error] [pid 24996:tid 25041] [client 20.166.9.204:15540] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/app.php"] [unique_id "afS8xSDBq9mMfUWQQeqE7QAAAI0"]
[Fri May 01 22:46:30.335973 2026] [:error] [pid 24997:tid 25063] [client 20.166.9.204:11139] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/403.php"] [unique_id "afS8xvOkHa4ScY5oo8znpgAAAMc"]
[Fri May 01 22:46:30.852063 2026] [:error] [pid 24997:tid 25052] [client 20.166.9.204:3760] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/cgi-bin/wp-2019.php"] [unique_id "afS8xvOkHa4ScY5oo8znpwAAAMI"]
[Fri May 01 22:46:31.389919 2026] [:error] [pid 24996:tid 25038] [client 20.166.9.204:1948] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/content.php"] [unique_id "afS8xyDBq9mMfUWQQeqE8AAAAIo"]
[Fri May 01 22:46:31.927025 2026] [:error] [pid 24996:tid 25037] [client 20.166.9.204:15524] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/admin.php"] [unique_id "afS8xyDBq9mMfUWQQeqE8gAAAIk"]
[Fri May 01 22:46:32.494422 2026] [:error] [pid 24996:tid 25057] [client 20.166.9.204:6150] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "afS8yCDBq9mMfUWQQeqE9AAAAJc"]
[Fri May 01 22:46:33.054513 2026] [:error] [pid 24997:tid 25080] [client 20.166.9.204:3128] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-head.php"] [unique_id "afS8yfOkHa4ScY5oo8znqgAAANg"]
[Fri May 01 22:46:33.587775 2026] [:error] [pid 25320:tid 25346] [client 20.166.9.204:1938] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/crack_self_restore.php"] [unique_id "afS8yVc3wJ-3-XaXB3oiiwAAARc"]
[Fri May 01 22:46:34.091182 2026] [:error] [pid 24997:tid 25046] [client 20.166.9.204:10558] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/db.php"] [unique_id "afS8yvOkHa4ScY5oo8znrAAAAMA"]
[Fri May 01 22:46:34.590670 2026] [:error] [pid 24997:tid 25075] [client 20.166.9.204:8755] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/ova-tools.php"] [unique_id "afS8yvOkHa4ScY5oo8znrgAAANM"]
[Fri May 01 22:46:35.090393 2026] [:error] [pid 24996:tid 25049] [client 20.166.9.204:12777] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/gecko.php"] [unique_id "afS8yyDBq9mMfUWQQeqE9wAAAJM"]
[Fri May 01 22:46:35.622873 2026] [:error] [pid 24997:tid 25076] [client 20.166.9.204:9602] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/public/admin.php"] [unique_id "afS8y_OkHa4ScY5oo8znsQAAANQ"]
[Fri May 01 22:46:36.123649 2026] [:error] [pid 33791:tid 33800] [client 20.166.9.204:12769] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "afS8zG9ixd-moLycM9A1xAAAAAY"]
[Fri May 01 22:46:36.643045 2026] [:error] [pid 24997:tid 25062] [client 20.166.9.204:5788] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp/abe.php"] [unique_id "afS8zPOkHa4ScY5oo8znsgAAAMY"]
[Fri May 01 22:46:37.279901 2026] [:error] [pid 24997:tid 25060] [client 20.166.9.204:2444] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/options.php"] [unique_id "afS8zfOkHa4ScY5oo8znswAAAMU"]
[Fri May 01 22:46:37.837686 2026] [:error] [pid 24997:tid 25073] [client 20.166.9.204:6974] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/gallery.php"] [unique_id "afS8zfOkHa4ScY5oo8zntAAAANE"]
[Fri May 01 22:46:38.373944 2026] [:error] [pid 25320:tid 25328] [client 20.166.9.204:4377] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/mini.php"] [unique_id "afS8zlc3wJ-3-XaXB3oijQAAAQU"]
[Fri May 01 22:46:38.948157 2026] [:error] [pid 25320:tid 25331] [client 20.166.9.204:9868] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/classsmtps.php"] [unique_id "afS8zlc3wJ-3-XaXB3oijwAAAQg"]
[Fri May 01 22:46:39.483702 2026] [:error] [pid 25320:tid 25333] [client 20.166.9.204:11063] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-load.php"] [unique_id "afS8z1c3wJ-3-XaXB3oikQAAAQo"]
[Fri May 01 22:46:40.035588 2026] [:error] [pid 24997:tid 25071] [client 20.166.9.204:10728] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "afS80POkHa4ScY5oo8znugAAAM8"]
[Fri May 01 22:46:40.585307 2026] [:error] [pid 24996:tid 25040] [client 20.166.9.204:3414] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/bypass.php"] [unique_id "afS80CDBq9mMfUWQQeqE-gAAAIw"]
[Fri May 01 22:46:41.120181 2026] [:error] [pid 33791:tid 33794] [client 20.166.9.204:14565] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/mariju.php"] [unique_id "afS80W9ixd-moLycM9A1xgAAAAA"]
[Fri May 01 22:46:41.655318 2026] [:error] [pid 25320:tid 25338] [client 20.166.9.204:10719] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/bs1.php"] [unique_id "afS80Vc3wJ-3-XaXB3oilgAAAQ8"]
[Fri May 01 22:46:42.176271 2026] [:error] [pid 24997:tid 25067] [client 20.166.9.204:4852] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/cloud.php"] [unique_id "afS80vOkHa4ScY5oo8znvgAAAMs"]
[Fri May 01 22:46:42.697487 2026] [:error] [pid 33791:tid 33808] [client 20.166.9.204:3456] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "afS80m9ixd-moLycM9A1xwAAAA4"]
[Fri May 01 22:46:43.237273 2026] [:error] [pid 33791:tid 33818] [client 20.166.9.204:1681] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/upgrade.php"] [unique_id "afS8029ixd-moLycM9A1yQAAABg"]
[Fri May 01 22:46:43.774506 2026] [:error] [pid 25085:tid 25092] [client 20.166.9.204:14142] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/mail.php"] [unique_id "afS80_uD8fWRiE0RX0EYMwAAAUE"]
[Fri May 01 22:46:44.274302 2026] [:error] [pid 33791:tid 33803] [client 20.166.9.204:4374] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/web.php"] [unique_id "afS81G9ixd-moLycM9A1zAAAAAk"]
[Fri May 01 22:46:44.773618 2026] [:error] [pid 33791:tid 33796] [client 20.166.9.204:5402] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/content.php"] [unique_id "afS81G9ixd-moLycM9A1zQAAAAI"]
[Fri May 01 22:46:45.308680 2026] [:error] [pid 24996:tid 25028] [client 20.166.9.204:3489] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/item.php"] [unique_id "afS81SDBq9mMfUWQQeqE_QAAAIA"]
[Fri May 01 22:46:45.862188 2026] [:error] [pid 50214:tid 50229] [client 20.166.9.204:14332] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/index1.php"] [unique_id "afS81Ys0pgrtfZkbhjN2_AAAAYs"]
[Fri May 01 22:46:46.385640 2026] [:error] [pid 25320:tid 25332] [client 20.166.9.204:4846] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "afS81lc3wJ-3-XaXB3oimgAAAQk"]
[Fri May 01 22:46:46.924905 2026] [:error] [pid 25320:tid 25340] [client 20.166.9.204:3513] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/cc.php"] [unique_id "afS81lc3wJ-3-XaXB3oinAAAARE"]
[Fri May 01 22:46:47.425859 2026] [:error] [pid 33791:tid 33799] [client 20.166.9.204:10115] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/admin.php"] [unique_id "afS8129ixd-moLycM9A10AAAAAU"]
[Fri May 01 22:46:47.929825 2026] [:error] [pid 25320:tid 25342] [client 20.166.9.204:4847] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/radio.php"] [unique_id "afS811c3wJ-3-XaXB3oinwAAARM"]
[Fri May 01 22:46:48.485367 2026] [:error] [pid 25320:tid 25331] [client 20.166.9.204:5445] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/cgi-bin/about.php"] [unique_id "afS82Fc3wJ-3-XaXB3oioQAAAQg"]
[Fri May 01 22:46:49.005818 2026] [:error] [pid 50214:tid 50225] [client 20.166.9.204:6102] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/user/network.php"] [unique_id "afS82Ys0pgrtfZkbhjN3AQAAAYc"]
[Fri May 01 22:46:49.540553 2026] [:error] [pid 33791:tid 33818] [client 20.166.9.204:5430] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "afS82W9ixd-moLycM9A10gAAABg"]
[Fri May 01 22:46:50.074873 2026] [:error] [pid 24996:tid 25048] [client 20.166.9.204:3481] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-cron.php"] [unique_id "afS82iDBq9mMfUWQQeqE_wAAAJI"]
[Fri May 01 22:46:50.607665 2026] [:error] [pid 24997:tid 25065] [client 20.166.9.204:14642] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/sidwsi.php"] [unique_id "afS82vOkHa4ScY5oo8znxAAAAMk"]
[Fri May 01 22:46:51.125282 2026] [:error] [pid 24995:tid 25000] [client 20.166.9.204:3451] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/item.php"] [unique_id "afS82-dJG9WB_Q_ne0vBrgAAAEE"]
[Fri May 01 22:46:53.225938 2026] [:error] [pid 24996:tid 25035] [client 20.166.9.204:1827] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/cgi-bin/cgi-bin/about.php7"] [unique_id "afS83SDBq9mMfUWQQeqFAAAAAIc"]
[Fri May 01 22:46:53.746911 2026] [:error] [pid 25085:tid 25096] [client 20.166.9.204:14128] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/admin.php"] [unique_id "afS83fuD8fWRiE0RX0EYOwAAAUU"]
[Fri May 01 22:46:54.246988 2026] [:error] [pid 33791:tid 33814] [client 20.166.9.204:3463] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-load.php"] [unique_id "afS83m9ixd-moLycM9A11AAAABQ"]
[Fri May 01 22:46:54.796572 2026] [:error] [pid 24997:tid 25062] [client 20.166.9.204:6344] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/htaccess.php"] [unique_id "afS83vOkHa4ScY5oo8znxQAAAMY"]
[Fri May 01 22:46:55.354545 2026] [:error] [pid 24997:tid 25052] [client 20.166.9.204:10880] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/install.php"] [unique_id "afS83_OkHa4ScY5oo8znxgAAAMI"]
[Fri May 01 22:46:55.889661 2026] [:error] [pid 24995:tid 25003] [client 20.166.9.204:1806] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "afS83-dJG9WB_Q_ne0vBuwAAAEQ"]
[Fri May 01 22:46:56.411037 2026] [:error] [pid 24995:tid 25019] [client 20.166.9.204:4393] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/images/file.php"] [unique_id "afS84OdJG9WB_Q_ne0vBvgAAAFQ"]
[Fri May 01 22:46:56.952224 2026] [:error] [pid 24995:tid 25007] [client 20.166.9.204:3487] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/pki-validation/classwithtostring.php"] [unique_id "afS84OdJG9WB_Q_ne0vBvwAAAEg"]
[Fri May 01 22:46:57.521724 2026] [:error] [pid 24996:tid 25028] [client 20.166.9.204:5500] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-help/index.php"] [unique_id "afS84SDBq9mMfUWQQeqFBQAAAIA"]
[Fri May 01 22:46:58.045549 2026] [:error] [pid 25320:tid 25329] [client 20.166.9.204:3470] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/home.php"] [unique_id "afS84lc3wJ-3-XaXB3oipgAAAQY"]
[Fri May 01 22:46:58.545841 2026] [:error] [pid 25320:tid 25330] [client 20.166.9.204:6135] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "afS84lc3wJ-3-XaXB3oiqAAAAQc"]
[Fri May 01 22:46:59.065970 2026] [:error] [pid 25320:tid 25344] [client 20.166.9.204:10116] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/vendor/composer/index.php"] [unique_id "afS841c3wJ-3-XaXB3oiqgAAARU"]
[Fri May 01 22:46:59.616087 2026] [:error] [pid 24996:tid 25029] [client 20.166.9.204:10915] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 12"] [hostname "paramountestate.com"] [uri "/wp-admin/cong.php"] [unique_id "afS84yDBq9mMfUWQQeqFBgAAAIE"]
[Fri May 01 22:47:00.149633 2026] [:error] [pid 24996:tid 25048] [client 20.166.9.204:9949] [client 20.166.9.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.166.9.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/wp-login.php"] [unique_id "afS85CDBq9mMfUWQQeqFBwAAAJI"]
[Fri May 01 22:47:00.149713 2026] [:error] [pid 24996:tid 25048] [client 20.166.9.204:9949] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/wp-content/wp-login.php"] [unique_id "afS85CDBq9mMfUWQQeqFBwAAAJI"]
[Fri May 01 22:47:00.740702 2026] [:error] [pid 24996:tid 25031] [client 20.166.9.204:3460] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/seoplugins/admin.php"] [unique_id "afS85CDBq9mMfUWQQeqFCgAAAIM"]
[Fri May 01 22:47:01.240582 2026] [:error] [pid 25085:tid 25091] [client 20.166.9.204:6517] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "afS85fuD8fWRiE0RX0EYPgAAAUA"]
[Fri May 01 22:47:01.759614 2026] [:error] [pid 24997:tid 25074] [client 20.166.9.204:6092] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/css.php"] [unique_id "afS85fOkHa4ScY5oo8znzgAAANI"]
[Fri May 01 22:47:02.315085 2026] [:error] [pid 25085:tid 25095] [client 20.166.9.204:16097] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "afS85vuD8fWRiE0RX0EYPwAAAUQ"]
[Fri May 01 22:47:02.848085 2026] [:error] [pid 24997:tid 25060] [client 20.166.9.204:16084] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/img/cloud.php"] [unique_id "afS85vOkHa4ScY5oo8zn0gAAAMU"]
[Fri May 01 22:47:03.364849 2026] [:error] [pid 24997:tid 25046] [client 20.166.9.204:14856] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/cloud.php"] [unique_id "afS85_OkHa4ScY5oo8zn1AAAAMA"]
[Fri May 01 22:47:03.888935 2026] [:error] [pid 33791:tid 33817] [client 20.166.9.204:15681] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/wp-content/themes/twentytwentytwo/admin.php"] [unique_id "afS8529ixd-moLycM9A12gAAABc"]
[Fri May 01 22:47:04.405381 2026] [:error] [pid 33791:tid 33809] [client 20.166.9.204:14622] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/updates.php"] [unique_id "afS86G9ixd-moLycM9A12wAAAA8"]
[Fri May 01 22:47:04.923779 2026] [:error] [pid 33791:tid 33800] [client 20.166.9.204:13764] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-help/admin/wp-fclass.php"] [unique_id "afS86G9ixd-moLycM9A13QAAAAY"]
[Fri May 01 22:47:05.440758 2026] [:error] [pid 33791:tid 33794] [client 20.166.9.204:5380] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/themes.php"] [unique_id "afS86W9ixd-moLycM9A14AAAAAA"]
[Fri May 01 22:47:06.012053 2026] [:error] [pid 24997:tid 25077] [client 20.166.9.204:4357] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/bless.php"] [unique_id "afS86vOkHa4ScY5oo8zn2AAAANU"]
[Fri May 01 22:47:06.526923 2026] [:error] [pid 25085:tid 25102] [client 20.166.9.204:5464] [client 20.166.9.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.166.9.204 on wp-login.php, counter = 13"] [hostname "paramountestate.com"] [uri "/index/admin.php"] [unique_id "afS86vuD8fWRiE0RX0EYQgAAAUs"]
[Fri May 01 23:17:31.236868 2026] [:error] [pid 25320:tid 25325] [client 170.106.84.136:50968] [client 170.106.84.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afTEC1c3wJ-3-XaXB3opygAAAQI"]
[Sat May 02 01:55:41.840753 2026] [:error] [pid 25320:tid 25335] [client 1.12.70.96:53732] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afTpHVc3wJ-3-XaXB3pWqwAAAQw"]
[Sat May 02 04:50:04.351943 2026] [:error] [pid 53435:tid 53495] [client 136.111.253.56:34660] [client 136.111.253.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "afUR_IDmp7_z8QkjSzMHYQAAAFc"]
[Sat May 02 08:00:57.460828 2026] [:error] [pid 53436:tid 53520] [client 43.157.149.188:35366] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afU-ua9N0xp8fccVM0CEywAAAJU"]
[Sat May 02 12:02:10.105717 2026] [:error] [pid 22846:tid 22849] [client 43.166.136.202:35060] [client 43.166.136.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afV3Qom1Ms03Mfhp3abUqwAAAQE"]
[Sat May 02 12:35:12.743796 2026] [:error] [pid 11894:tid 11902] [client 192.96.159.129:59817] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "afV_ADHh6DQF1tkXIKyiiwAAAUU"]
[Sat May 02 12:35:16.109571 2026] [:error] [pid 11894:tid 11908] [client 192.96.159.129:59818] [client 192.96.159.129] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "185.223.152.158_1308642acc85a04205bb287c096e29292f6d91cc"): Internal error (specific information not available) [hostname "paramountestate.com"] [uri "/"] [unique_id "afV_ADHh6DQF1tkXIKyijAAAAUs"]
[Sat May 02 13:49:45.797378 2026] [:error] [pid 51950:tid 51988] [client 175.178.110.121:33204] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afWQeYoBJzYZ3RKUhdj_CAAAAkg"]
[Sat May 02 15:19:12.096764 2026] [:error] [pid 51950:tid 51982] [client 43.159.128.155:38522] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afWlcIoBJzYZ3RKUhdgRrAAAAkI"]
[Sat May 02 18:42:34.050999 2026] [:error] [pid 53436:tid 53506] [client 45.24.22.8:62392] [client 45.24.22.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.24.22.8, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afXVGq9N0xp8fccVM0DKdwAAAIc"]
[Sat May 02 20:48:18.186651 2026] [:error] [pid 53435:tid 53478] [client 170.106.180.153:35950] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afXykoDmp7_z8QkjSzPAEQAAAEY"]
[Sun May 03 02:14:36.811350 2026] [:error] [pid 52012:tid 52087] [client 43.130.16.212:43614] [client 43.130.16.212] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afY_DEzSWr-8cpS83mgoOgAAA0o"]
[Sun May 03 09:44:32.993383 2026] [:error] [pid 37246:tid 37272] [client 43.153.122.30:55898] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afaogDhvYFGNwhnPamqVFgAAARY"]
[Sun May 03 11:26:51.387142 2026] [:error] [pid 40422:tid 40439] [client 209.87.169.28:51565] [client 209.87.169.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "afbAe0HBbBLrXh6PBuvLvgAAAU0"]
[Sun May 03 12:34:37.608783 2026] [:error] [pid 37130:tid 37226] [client 43.157.180.116:44794] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afbQXaIu7bmXKXicRk9auwAAAI0"]
[Sun May 03 15:28:15.118706 2026] [:error] [pid 40456:tid 40482] [client 43.135.133.241:56094] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afb5DzSujTvwdzEkjSc2ngAAAZg"]
[Sun May 03 17:18:10.080071 2026] [:error] [pid 37130:tid 37217] [client 213.246.11.140:55872] [client 213.246.11.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.246.11.140, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afcS0qIu7bmXKXicRk98agAAAIQ"]
[Sun May 03 18:11:29.416470 2026] [:error] [pid 54535:tid 54544] [client 43.165.7.135:58810] [client 43.165.7.135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afcfUfRyz79iR-ntJRLTKAAAAgc"]
[Sun May 03 20:49:19.183859 2026] [:error] [pid 37127:tid 37207] [client 43.133.66.51:43894] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afdET_8khJXb5O5aWVVHvwAAAFU"]
[Mon May 04 02:08:02.752439 2026] [:error] [pid 37246:tid 37268] [client 49.51.72.76:59516] [client 49.51.72.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afePAjhvYFGNwhnPampLFQAAARI"]
[Mon May 04 03:56:46.148534 2026] [:error] [pid 57154:tid 57179] [client 43.138.68.113:43656] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afeofv4DAn7umy_ATRy93AAAANY"]
[Mon May 04 08:10:36.313817 2026] [:error] [pid 12051:tid 12076] [client 43.130.139.177:40168] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "affj_OrVB-w_PyOHK6kyXwAAAVc"]
[Mon May 04 09:32:45.719388 2026] [:error] [pid 12022:tid 12034] [client 52.165.198.204:8660] [client 52.165.198.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.165.198.204, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aff3PUVhgvCNKBWnaTI-9QAAAIo"]
[Mon May 04 09:32:47.883913 2026] [:error] [pid 12022:tid 12041] [client 52.165.198.204:8660] [client 52.165.198.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.165.198.204, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aff3P0VhgvCNKBWnaTI-_gAAAJE"]
[Mon May 04 09:32:51.011847 2026] [:error] [pid 12022:tid 12030] [client 52.165.198.204:8660] [client 52.165.198.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aff3Q0VhgvCNKBWnaTI_EQAAAIY"]
[Mon May 04 09:55:51.054536 2026] [:error] [pid 12051:tid 12056] [client 20.9.90.138:14222] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8p-rVB-w_PyOHK6lfDQAAAUM"]
[Mon May 04 09:55:51.814513 2026] [:error] [pid 12051:tid 12061] [client 20.9.90.138:14256] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8p-rVB-w_PyOHK6lfEgAAAUg"]
[Mon May 04 09:55:52.575328 2026] [:error] [pid 11959:tid 12004] [client 20.9.90.138:14220] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8qAojk2nvxs7h5KvhLwAAANA"]
[Mon May 04 09:55:54.058656 2026] [:error] [pid 33186:tid 33190] [client 20.9.90.138:13580] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8qrqlqe0DcmBS9VzwzQAAAAE"]
[Mon May 04 13:57:30.573017 2026] [:error] [pid 12051:tid 12058] [client 43.130.53.252:53510] [client 43.130.53.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afg1SurVB-w_PyOHK6mbAQAAAUU"]
[Mon May 04 15:47:49.333592 2026] [:error] [pid 3341:tid 3350] [client 175.27.171.245:43748] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afhPJU9o3_LordU0wW7sJgAAAIY"]
[Mon May 04 17:12:06.532646 2026] [:error] [pid 61042:tid 61060] [client 182.181.235.215:59854] [client 182.181.235.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.181.235.215, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afhi5knAPPS1fjubA9Q7BgAAAM4"]
[Mon May 04 19:12:07.672374 2026] [:error] [pid 3341:tid 3346] [client 43.130.14.245:49548] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afh_B09o3_LordU0wW4xPAAAAII"]
[Tue May 05 00:11:00.430215 2026] [:error] [pid 32471:tid 32481] [client 43.153.79.218:43862] [client 43.153.79.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afjFFHmjpb9EYq6AqhKYWgAAAQc"]
[Tue May 05 00:32:11.509044 2026] [:error] [pid 61042:tid 61046] [client 4.197.82.33:2970] [client 4.197.82.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.197.82.33, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "afjKC0nAPPS1fjubA9R3WAAAAMA"]
[Tue May 05 00:32:11.695264 2026] [:error] [pid 61042:tid 61057] [client 4.197.82.33:2970] [client 4.197.82.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.197.82.33, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afjKC0nAPPS1fjubA9R3YQAAAMs"]
[Tue May 05 00:32:11.935374 2026] [:error] [pid 61042:tid 61048] [client 4.197.82.33:2970] [client 4.197.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "afjKC0nAPPS1fjubA9R3bQAAAMI"]
[Tue May 05 03:00:41.750993 2026] [:error] [pid 32471:tid 32484] [client 43.155.157.239:55212] [client 43.155.157.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afjs2Xmjpb9EYq6AqhLKfAAAAQo"]
[Tue May 05 03:40:19.108461 2026] [:error] [pid 32471:tid 32482] [client 209.87.169.230:49707] [client 209.87.169.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "afj2I3mjpb9EYq6AqhLYjQAAAQg"]
[Tue May 05 04:53:41.645850 2026] [:error] [pid 39073:tid 39148] [client 20.29.119.89:16265] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afkHVf0kT1BNjk46BkcMzgAAAI4"]
[Tue May 05 04:53:42.032082 2026] [:error] [pid 39071:tid 39096] [client 20.29.119.89:16349] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afkHVovmnRMz9gRzix1QYwAAABA"]
[Tue May 05 04:53:42.408361 2026] [:error] [pid 39073:tid 39144] [client 20.29.119.89:16351] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afkHVv0kT1BNjk46BkcM0QAAAIo"]
[Tue May 05 04:53:42.786727 2026] [:error] [pid 39073:tid 39141] [client 20.29.119.89:16264] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afkHVv0kT1BNjk46BkcM1AAAAIc"]
[Tue May 05 04:53:51.440049 2026] [:error] [pid 41055:tid 41074] [client 175.27.163.171:53754] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afkHXyepFwKgA_SKOHiiJQAAARA"]
[Tue May 05 05:59:56.705814 2026] [:error] [pid 39073:tid 39148] [client 43.159.152.4:56994] [client 43.159.152.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afkW3P0kT1BNjk46BkcdEgAAAI4"]
[Tue May 05 07:46:09.577808 2026] [:error] [pid 39073:tid 39150] [client 45.86.200.104:32655] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afkvwf0kT1BNjk46Bkdr0QAAAJA"]
[Tue May 05 07:46:11.061518 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.86:61647] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "afkvw4vmnRMz9gRzix2hKgAAAA4"]
[Tue May 05 07:46:13.401667 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.81:51649] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "afkvxYvmnRMz9gRzix2hVAAAAAM"]
[Tue May 05 07:46:14.810541 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.84:36943] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/index.php"] [unique_id "afkvxnG_NPOxSH0O9aQVTwAAAUc"]
[Tue May 05 07:46:17.070308 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.80:44945] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "afkvyXG_NPOxSH0O9aQV3wAAAUE"]
[Tue May 05 07:46:17.898139 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.85:55193] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "afkvyXG_NPOxSH0O9aQWGgAAAVg"]
[Tue May 05 07:46:18.482024 2026] [:error] [pid 41055:tid 41072] [client 45.86.200.92:27605] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "afkvyiepFwKgA_SKOHgUHAAAAQ4"]
[Tue May 05 07:46:19.025276 2026] [:error] [pid 41055:tid 41064] [client 45.86.200.110:51355] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "afkvyyepFwKgA_SKOHgUMQAAAQY"]
[Tue May 05 07:46:19.565435 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.97:43313] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "afkvy3G_NPOxSH0O9aQWbQAAAUQ"]
[Tue May 05 07:46:20.096118 2026] [:error] [pid 39072:tid 39117] [client 45.86.200.109:48519] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "afkvzPolSHl4aAnrIosrcwAAAEo"]
[Tue May 05 07:46:20.961167 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.100:33079] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "afkvzPolSHl4aAnrIosrkQAAAEc"]
[Tue May 05 07:46:22.047724 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.100:30347] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "afkvzvolSHl4aAnrIosrvwAAAEs"]
[Tue May 05 07:46:23.200944 2026] [:error] [pid 39073:tid 39150] [client 45.86.200.80:38107] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "afkvz_0kT1BNjk46Bkds-gAAAJA"]
[Tue May 05 07:46:25.133473 2026] [:error] [pid 41055:tid 41064] [client 45.86.200.53:47749] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "afkv0SepFwKgA_SKOHgU2gAAAQY"]
[Tue May 05 07:46:25.974955 2026] [:error] [pid 39073:tid 39141] [client 45.86.200.86:42229] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "afkv0f0kT1BNjk46BkdtPgAAAIc"]
[Tue May 05 07:46:28.216137 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.93:60475] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "afkv1HG_NPOxSH0O9aQYnAAAAUI"]
[Tue May 05 07:46:29.034882 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.100:58157] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "afkv1YvmnRMz9gRzix2ivAAAABU"]
[Tue May 05 07:46:30.131002 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.96:65439] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/defaults.php"] [unique_id "afkv1volSHl4aAnrIossuQAAAEE"]
[Tue May 05 07:46:30.948049 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.58:63217] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/index.php"] [unique_id "afkv1nG_NPOxSH0O9aQZIwAAAUY"]
[Tue May 05 07:46:32.652479 2026] [:error] [pid 39073:tid 39142] [client 45.86.200.52:45405] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "afkv2P0kT1BNjk46Bkdt3gAAAIg"]
[Tue May 05 07:46:33.504164 2026] [:error] [pid 41055:tid 41070] [client 45.86.200.59:58263] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "afkv2SepFwKgA_SKOHgVywAAAQw"]
[Tue May 05 07:46:34.382561 2026] [:error] [pid 39072:tid 39125] [client 45.86.200.107:55835] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "afkv2volSHl4aAnrIostWQAAAFI"]
[Tue May 05 07:46:34.951791 2026] [:error] [pid 39072:tid 39128] [client 45.86.200.99:38049] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "afkv2volSHl4aAnrIostdQAAAFU"]
[Tue May 05 07:46:35.609342 2026] [:error] [pid 39071:tid 39080] [client 45.86.200.98:47875] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afkv24vmnRMz9gRzix2jfQAAAAA"]
[Tue May 05 07:46:37.047800 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.100:43275] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/info.php"] [unique_id "afkv3SepFwKgA_SKOHgWHwAAAQM"]
[Tue May 05 07:46:38.630213 2026] [:error] [pid 39073:tid 39141] [client 45.86.200.106:26173] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class.api.php"] [unique_id "afkv3v0kT1BNjk46BkdumwAAAIc"]
[Tue May 05 07:46:39.197139 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.105:46995] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "afkv3yepFwKgA_SKOHgWVQAAAQo"]
[Tue May 05 07:46:42.069712 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.52:40221] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/admin.php"] [unique_id "afkv4nG_NPOxSH0O9aQbRQAAAVA"]
[Tue May 05 07:46:43.506430 2026] [:error] [pid 41055:tid 41078] [client 45.86.200.76:24679] [client 45.86.200.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.76, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afkv4yepFwKgA_SKOHgWxwAAARQ"]
[Tue May 05 07:46:47.043344 2026] [:error] [pid 41055:tid 41078] [client 45.86.200.76:24679] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "afkv5yepFwKgA_SKOHgXQAAAARQ"]
[Tue May 05 07:46:48.210520 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.51:55353] [client 45.86.200.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.51, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "afkv6HG_NPOxSH0O9aQcjAAAAUI"]
[Tue May 05 07:46:48.852600 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.51:55353] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/item.php"] [unique_id "afkv6HG_NPOxSH0O9aQcrwAAAVY"]
[Tue May 05 07:46:51.905280 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.91:60233] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "afkv63G_NPOxSH0O9aQdbQAAAUE"]
[Tue May 05 07:46:54.735024 2026] [:error] [pid 39071:tid 39097] [client 45.86.200.58:41925] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "afkv7ovmnRMz9gRzix2lBAAAABE"]
[Tue May 05 07:46:55.939623 2026] [:error] [pid 39073:tid 39154] [client 45.86.200.96:51321] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "afkv7_0kT1BNjk46Bkdw2QAAAJQ"]
[Tue May 05 07:46:57.369837 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.104:26957] [client 45.86.200.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.104, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/wp-login.php"] [unique_id "afkv8folSHl4aAnrIoswOgAAAE8"]
[Tue May 05 07:46:57.684484 2026] [:error] [pid 39072:tid 39127] [client 45.86.200.104:26957] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "afkv8folSHl4aAnrIoswRgAAAFQ"]
[Tue May 05 07:47:03.300393 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.89:44617] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "afkv9zaPrgTaiOD_15u3mQAAAMM"]
[Tue May 05 07:47:04.719474 2026] [:error] [pid 39178:tid 39187] [client 45.86.200.54:52431] [client 45.86.200.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.54, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "afkv-DaPrgTaiOD_15u36AAAAMc"]
[Tue May 05 07:47:05.868178 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.54:52431] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about.php"] [unique_id "afkv-TaPrgTaiOD_15u4HwAAANc"]
[Tue May 05 07:47:06.691591 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.53:28187] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/infi.php"] [unique_id "afkv-volSHl4aAnrIosxhQAAAEQ"]
[Tue May 05 07:47:07.809098 2026] [:error] [pid 39178:tid 39204] [client 45.86.200.81:41449] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "afkv-zaPrgTaiOD_15u4ZgAAANg"]
[Tue May 05 07:47:09.281573 2026] [:error] [pid 39073:tid 39134] [client 185.82.72.4:29041] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "afkv_f0kT1BNjk46BkdyUAAAAIA"]
[Tue May 05 07:47:09.826361 2026] [:error] [pid 41055:tid 41076] [client 45.86.200.82:29713] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "afkv_SepFwKgA_SKOHgaKAAAARI"]
[Tue May 05 07:47:16.225645 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.74:21489] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "afkwBCepFwKgA_SKOHga3gAAAQc"]
[Tue May 05 07:47:17.051458 2026] [:error] [pid 39071:tid 39098] [client 45.86.200.85:28583] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "afkwBYvmnRMz9gRzix2msQAAABI"]
[Tue May 05 07:47:18.459655 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.75:61021] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit.php"] [unique_id "afkwBnG_NPOxSH0O9aQh5gAAAUs"]
[Tue May 05 07:47:19.904781 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.82:52099] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "afkwBzaPrgTaiOD_15u6mAAAAM8"]
[Tue May 05 07:47:22.153370 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.84:62951] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/click.php"] [unique_id "afkwCnG_NPOxSH0O9aQibwAAAUA"]
[Tue May 05 07:47:23.561516 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.109:57277] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "afkwC3G_NPOxSH0O9aQioAAAAUg"]
[Tue May 05 07:47:27.240725 2026] [:error] [pid 41055:tid 41063] [client 45.86.200.94:62229] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "afkwDyepFwKgA_SKOHgcBAAAAQU"]
[Tue May 05 07:47:27.779498 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.60:61403] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/xl2023.php"] [unique_id "afkwD_0kT1BNjk46Bkd0RgAAAJE"]
[Tue May 05 07:47:28.366160 2026] [:error] [pid 41055:tid 41069] [client 45.86.200.77:55705] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "afkwECepFwKgA_SKOHgcGgAAAQs"]
[Tue May 05 07:47:28.966120 2026] [:error] [pid 39071:tid 39104] [client 45.86.200.52:35283] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "afkwEIvmnRMz9gRzix2n8wAAABg"]
[Tue May 05 07:47:29.852343 2026] [:error] [pid 39073:tid 39143] [client 45.86.200.82:52787] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "afkwEf0kT1BNjk46Bkd0dgAAAIk"]
[Tue May 05 07:47:30.394670 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.99:46859] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "afkwEnG_NPOxSH0O9aQjmgAAAVg"]
[Tue May 05 07:47:31.502814 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.99:38065] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/index.php"] [unique_id "afkwE4vmnRMz9gRzix2oNwAAABU"]
[Tue May 05 07:47:32.069050 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.112:58077] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "afkwFP0kT1BNjk46Bkd0rAAAAJE"]
[Tue May 05 07:47:32.675593 2026] [:error] [pid 39071:tid 39089] [client 45.86.200.80:50207] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "afkwFIvmnRMz9gRzix2oWAAAAAk"]
[Tue May 05 07:47:33.217121 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.92:36689] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "afkwFXG_NPOxSH0O9aQkBwAAAUQ"]
[Tue May 05 07:47:34.087824 2026] [:error] [pid 39073:tid 39148] [client 45.86.200.107:35733] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "afkwFv0kT1BNjk46Bkd02QAAAI4"]
[Tue May 05 07:47:35.197479 2026] [:error] [pid 39071:tid 39084] [client 45.86.200.74:47847] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "afkwF4vmnRMz9gRzix2ohQAAAAQ"]
[Tue May 05 07:47:36.869957 2026] [:error] [pid 39071:tid 39090] [client 45.86.200.77:35217] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "afkwGIvmnRMz9gRzix2oswAAAAo"]
[Tue May 05 07:47:39.368972 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.92:35113] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/file.php"] [unique_id "afkwG3G_NPOxSH0O9aQlFAAAAVg"]
[Tue May 05 07:47:40.751414 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.54:24333] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "afkwHHG_NPOxSH0O9aQlagAAAVA"]
[Tue May 05 07:47:41.284441 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.60:20497] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "afkwHXG_NPOxSH0O9aQlkQAAAUQ"]
[Tue May 05 07:47:42.958584 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.108:51815] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "afkwHnG_NPOxSH0O9aQmAgAAAVE"]
[Tue May 05 07:47:44.358308 2026] [proxy_fcgi:error] [pid 39178:tid 39200] [client 45.86.200.59:33655] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:47:44.664959 2026] [proxy_fcgi:error] [pid 39178:tid 39204] [client 45.86.200.59:33655] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:47:44.941492 2026] [proxy_fcgi:error] [pid 39178:tid 39193] [client 45.86.200.59:33655] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:47:46.324629 2026] [:error] [pid 39178:tid 39196] [client 45.86.200.59:33655] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "afkwIjaPrgTaiOD_15u-LAAAANA"]
[Tue May 05 07:47:46.879443 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.107:48817] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "afkwInG_NPOxSH0O9aQmzgAAAVc"]
[Tue May 05 07:47:47.415149 2026] [:error] [pid 39071:tid 39087] [client 45.86.200.110:35549] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "afkwI4vmnRMz9gRzix2qDgAAAAc"]
[Tue May 05 07:47:47.980435 2026] [:error] [pid 39072:tid 39112] [client 45.86.200.112:24617] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "afkwI_olSHl4aAnrIos4AAAAAEU"]
[Tue May 05 07:47:48.559191 2026] [:error] [pid 39072:tid 39123] [client 45.86.200.97:31261] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "afkwJPolSHl4aAnrIos4FgAAAFA"]
[Tue May 05 07:47:49.123677 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.109:37521] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "afkwJTaPrgTaiOD_15u-jgAAANI"]
[Tue May 05 07:47:49.976894 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.103:30289] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "afkwJf0kT1BNjk46Bkd2dQAAAJY"]
[Tue May 05 07:47:51.617381 2026] [:error] [pid 39073:tid 39150] [client 45.86.200.58:47725] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "afkwJ_0kT1BNjk46Bkd2mgAAAJA"]
[Tue May 05 07:47:52.159285 2026] [:error] [pid 41055:tid 41062] [client 45.86.200.97:21825] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "afkwKCepFwKgA_SKOHgfPgAAAQQ"]
[Tue May 05 07:47:52.705069 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.99:44483] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "afkwKDaPrgTaiOD_15u_AwAAANE"]
[Tue May 05 07:47:53.796486 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.57:33335] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "afkwKXG_NPOxSH0O9aQoLAAAAVI"]
[Tue May 05 07:47:54.613413 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.85:32565] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "afkwKv0kT1BNjk46Bkd20wAAAIM"]
[Tue May 05 07:47:55.768361 2026] [:error] [pid 39072:tid 39113] [client 45.86.200.106:46369] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "afkwK_olSHl4aAnrIos5EQAAAEY"]
[Tue May 05 07:47:56.857563 2026] [:error] [pid 39178:tid 39187] [client 45.86.200.76:50891] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/about.php"] [unique_id "afkwLDaPrgTaiOD_15u_lAAAAMc"]
[Tue May 05 07:47:58.250962 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.102:59841] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "afkwLiepFwKgA_SKOHgf8gAAAQc"]
[Tue May 05 07:47:59.944319 2026] [:error] [pid 39073:tid 39154] [client 45.86.200.93:47263] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "afkwL_0kT1BNjk46Bkd3YAAAAJQ"]
[Tue May 05 07:48:00.779259 2026] [:error] [pid 41055:tid 41059] [client 185.82.72.3:26957] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-class.php"] [unique_id "afkwMCepFwKgA_SKOHggVQAAAQE"]
[Tue May 05 07:48:09.520181 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.55:21847] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "afkwOTaPrgTaiOD_15vBFgAAAMM"]
[Tue May 05 07:48:10.064471 2026] [:error] [pid 39071:tid 39100] [client 45.86.200.53:64389] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "afkwOovmnRMz9gRzix2sfAAAABQ"]
[Tue May 05 07:48:10.882219 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.107:48371] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "afkwOnG_NPOxSH0O9aQr0QAAAVQ"]
[Tue May 05 07:48:11.970368 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.59:64869] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "afkwOyepFwKgA_SKOHghuAAAAQI"]
[Tue May 05 07:48:12.536342 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.107:37085] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "afkwPCepFwKgA_SKOHghzQAAAQc"]
[Tue May 05 07:48:14.264377 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.53:28535] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afkwPv0kT1BNjk46Bkd5dwAAAIM"]
[Tue May 05 07:48:14.823380 2026] [:error] [pid 39071:tid 39098] [client 45.86.200.78:39573] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "afkwPovmnRMz9gRzix2tAQAAABI"]
[Tue May 05 07:48:16.846803 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.80:35919] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "afkwQDaPrgTaiOD_15vBwwAAANI"]
[Tue May 05 07:48:17.662289 2026] [proxy_fcgi:error] [pid 39072:tid 39124] [client 45.86.200.74:34489] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:18.226929 2026] [:error] [pid 39072:tid 39117] [client 45.86.200.74:34489] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/function.php"] [unique_id "afkwQvolSHl4aAnrIos7sQAAAEo"]
[Tue May 05 07:48:18.788189 2026] [:error] [pid 39178:tid 39191] [client 45.86.200.88:31987] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/plugins.php"] [unique_id "afkwQjaPrgTaiOD_15vB9AAAAMs"]
[Tue May 05 07:48:19.950654 2026] [:error] [pid 39071:tid 39089] [client 185.82.72.4:61545] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "afkwQ4vmnRMz9gRzix2tagAAAAk"]
[Tue May 05 07:48:20.483876 2026] [:error] [pid 41055:tid 41072] [client 45.86.200.108:37863] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "afkwRCepFwKgA_SKOHgi4AAAAQ4"]
[Tue May 05 07:48:23.092452 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.96:55237] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/atomlib.php"] [unique_id "afkwRyepFwKgA_SKOHgjTQAAAQ8"]
[Tue May 05 07:48:23.636422 2026] [:error] [pid 39071:tid 39099] [client 45.86.200.95:23481] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "afkwR4vmnRMz9gRzix2txAAAABM"]
[Tue May 05 07:48:25.360071 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.52:56891] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "afkwSXG_NPOxSH0O9aQuAgAAAVA"]
[Tue May 05 07:48:25.898069 2026] [:error] [pid 39178:tid 39188] [client 185.82.72.3:29029] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "afkwSTaPrgTaiOD_15vChAAAAMg"]
[Tue May 05 07:48:26.511794 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.105:44867] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "afkwSnG_NPOxSH0O9aQuNgAAAUs"]
[Tue May 05 07:48:28.439211 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.111:50349] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "afkwTHG_NPOxSH0O9aQunQAAAUo"]
[Tue May 05 07:48:29.318935 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.78:34647] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "afkwTf0kT1BNjk46Bkd7EgAAAIo"]
[Tue May 05 07:48:31.881383 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.56:22031] [client 45.86.200.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.56, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/js/wp-login.php"] [unique_id "afkwT_0kT1BNjk46Bkd7aAAAAIw"]
[Tue May 05 07:48:33.620644 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.56:22031] [client 45.86.200.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.56, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "afkwUf0kT1BNjk46Bkd7hQAAAIw"]
[Tue May 05 07:48:36.828312 2026] [proxy_fcgi:error] [pid 39073:tid 39152] [client 45.86.200.56:22031] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:41.110108 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.56:22031] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/about.php"] [unique_id "afkwWf0kT1BNjk46Bkd8PwAAAIo"]
[Tue May 05 07:48:42.493409 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.87:24267] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "afkwWvolSHl4aAnrIos_CAAAAEs"]
[Tue May 05 07:48:43.599497 2026] [:error] [pid 39073:tid 39138] [client 45.86.200.76:47459] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "afkwW_0kT1BNjk46Bkd8hwAAAIQ"]
[Tue May 05 07:48:46.762436 2026] [:error] [pid 39178:tid 39182] [client 45.86.200.89:56971] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "afkwXjaPrgTaiOD_15vElQAAAMI"]
[Tue May 05 07:48:47.916093 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.90:38447] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "afkwX3G_NPOxSH0O9aQxfgAAAUQ"]
[Tue May 05 07:48:48.734318 2026] [:error] [pid 39178:tid 39201] [client 45.86.200.83:41749] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "afkwYDaPrgTaiOD_15vEygAAANU"]
[Tue May 05 07:48:50.439323 2026] [proxy_fcgi:error] [pid 41055:tid 41071] [client 45.86.200.73:21661] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:50.759308 2026] [proxy_fcgi:error] [pid 41055:tid 41068] [client 45.86.200.73:21661] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:51.025133 2026] [:error] [pid 41055:tid 41062] [client 45.86.200.73:21661] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "afkwYyepFwKgA_SKOHgnbQAAAQQ"]
[Tue May 05 07:48:51.573114 2026] [:error] [pid 39178:tid 39180] [client 45.86.200.111:48087] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "afkwYzaPrgTaiOD_15vFFAAAAMA"]
[Tue May 05 07:48:54.292558 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.53:49265] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "afkwZv0kT1BNjk46Bkd9zQAAAIw"]
[Tue May 05 07:48:55.155176 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.80:58583] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "afkwZyepFwKgA_SKOHgn4wAAARU"]
[Tue May 05 07:48:56.534967 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.85:59865] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "afkwaHG_NPOxSH0O9aQy0wAAAUM"]
[Tue May 05 07:48:59.092209 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.77:22461] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "afkwazaPrgTaiOD_15vFywAAANI"]
[Tue May 05 07:48:59.652427 2026] [proxy_fcgi:error] [pid 53856:tid 53880] [client 45.86.200.106:36233] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:00.970629 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.106:36233] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "afkwbHG_NPOxSH0O9aQzXAAAAUE"]
[Tue May 05 07:49:06.984324 2026] [proxy_fcgi:error] [pid 39178:tid 39185] [client 45.86.200.75:24465] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:07.648470 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.75:24465] [client 45.86.200.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.75, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "afkwczaPrgTaiOD_15vGjwAAANQ"]
[Tue May 05 07:49:09.864767 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.75:24465] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "afkwdTaPrgTaiOD_15vG3gAAANI"]
[Tue May 05 07:49:11.567573 2026] [:error] [pid 39073:tid 39149] [client 45.86.200.80:21073] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "afkwd_0kT1BNjk46Bkd_agAAAI8"]
[Tue May 05 07:49:14.402300 2026] [:error] [pid 39071:tid 39087] [client 45.86.200.102:36097] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "afkweovmnRMz9gRzix2zZAAAAAc"]
[Tue May 05 07:49:19.237924 2026] [:error] [pid 39072:tid 39115] [client 45.86.200.99:61131] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "afkwf_olSHl4aAnrIotCvwAAAEg"]
[Tue May 05 07:49:19.771327 2026] [:error] [pid 39178:tid 39184] [client 45.86.200.78:28087] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "afkwfzaPrgTaiOD_15vIGAAAAMQ"]
[Tue May 05 07:49:21.205965 2026] [:error] [pid 39071:tid 39104] [client 45.86.200.56:55471] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "afkwgYvmnRMz9gRzix20HQAAABg"]
[Tue May 05 07:49:22.332621 2026] [proxy_fcgi:error] [pid 39073:tid 39149] [client 45.86.200.110:58939] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:22.602210 2026] [:error] [pid 39073:tid 39155] [client 45.86.200.110:58939] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "afkwgv0kT1BNjk46BkeAmQAAAJU"]
[Tue May 05 07:49:23.485590 2026] [:error] [pid 39178:tid 39187] [client 45.86.200.79:59227] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/db.php"] [unique_id "afkwgzaPrgTaiOD_15vIfgAAAMc"]
[Tue May 05 07:49:24.030469 2026] [:error] [pid 39073:tid 39145] [client 45.86.200.74:38815] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "afkwhP0kT1BNjk46BkeAvgAAAIs"]
[Tue May 05 07:49:24.572174 2026] [:error] [pid 39071:tid 39095] [client 45.86.200.102:34313] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "afkwhIvmnRMz9gRzix20dwAAAA8"]
[Tue May 05 07:49:25.124951 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.94:60435] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "afkwhSepFwKgA_SKOHgrAAAAAQ8"]
[Tue May 05 07:49:26.768550 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.88:22539] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "afkwhvolSHl4aAnrIotD5QAAAEk"]
[Tue May 05 07:49:27.319105 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.75:54575] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "afkwh_0kT1BNjk46BkeBDgAAAJE"]
[Tue May 05 07:49:28.439563 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.52:40559] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "afkwiDaPrgTaiOD_15vI-gAAANY"]
[Tue May 05 07:49:28.993674 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.74:40433] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "afkwiDaPrgTaiOD_15vJCwAAAM8"]
[Tue May 05 07:49:29.524723 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.96:64437] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "afkwiXG_NPOxSH0O9aQ22AAAAVI"]
[Tue May 05 07:49:30.108220 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.80:25999] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "afkwiovmnRMz9gRzix21DAAAAAI"]
[Tue May 05 07:49:30.654509 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.96:29283] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/options.php"] [unique_id "afkwiiepFwKgA_SKOHgrxQAAARM"]
[Tue May 05 07:49:31.221696 2026] [proxy_fcgi:error] [pid 39072:tid 39127] [client 45.86.200.100:53499] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:37.827536 2026] [:error] [pid 39072:tid 39110] [client 45.86.200.100:53499] [client 45.86.200.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.100, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "afkwkfolSHl4aAnrIotFcgAAAEM"]
[Tue May 05 07:49:39.252043 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.100:53499] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "afkwk_olSHl4aAnrIotFqwAAAEI"]
[Tue May 05 07:49:44.385124 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.74:64577] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "afkwmDaPrgTaiOD_15vKtwAAAMY"]
[Tue May 05 07:49:44.950160 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.94:43935] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "afkwmHG_NPOxSH0O9aQ5jQAAAU4"]
[Tue May 05 07:49:45.525884 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.53:41917] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "afkwmXG_NPOxSH0O9aQ5rQAAAVA"]
[Tue May 05 07:49:47.784348 2026] [:error] [pid 39072:tid 39131] [client 45.86.200.107:42401] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "afkwm_olSHl4aAnrIotG5gAAAFg"]
[Tue May 05 07:49:48.338352 2026] [:error] [pid 39178:tid 39180] [client 45.86.200.92:61297] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "afkwnDaPrgTaiOD_15vLIAAAAMA"]
[Tue May 05 07:49:48.894407 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.111:62233] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "afkwnPolSHl4aAnrIotG_gAAAEQ"]
[Tue May 05 07:49:50.573396 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.101:56063] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "afkwnnG_NPOxSH0O9aQ6qwAAAUU"]
[Tue May 05 07:49:51.396134 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.102:55337] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "afkwn_olSHl4aAnrIotHTgAAAFE"]
[Tue May 05 07:49:52.532337 2026] [:error] [pid 39072:tid 39128] [client 45.86.200.94:26927] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "afkwoPolSHl4aAnrIotHdgAAAFU"]
[Tue May 05 07:49:56.171725 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.100:63207] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "afkwpHG_NPOxSH0O9aQ72AAAAVM"]
[Tue May 05 07:49:57.037985 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.98:22267] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/about.php"] [unique_id "afkwpXG_NPOxSH0O9aQ8CwAAAUs"]
[Tue May 05 07:49:59.319575 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.74:57505] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "afkwp4vmnRMz9gRzix24BgAAAA4"]
[Tue May 05 07:50:04.342111 2026] [:error] [pid 39178:tid 39199] [client 45.86.200.85:55211] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "afkwrDaPrgTaiOD_15vMxwAAANM"]
[Tue May 05 07:50:06.066594 2026] [:error] [pid 39071:tid 39089] [client 45.86.200.51:32013] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "afkwrovmnRMz9gRzix24mgAAAAk"]
[Tue May 05 07:50:07.893582 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.106:55757] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "afkwr_0kT1BNjk46BkeFbgAAAJY"]
[Tue May 05 07:50:09.042665 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.80:33543] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "afkwsTaPrgTaiOD_15vNUQAAANY"]
[Tue May 05 07:50:09.600898 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.51:62907] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "afkwsXG_NPOxSH0O9aQ-kgAAAUM"]
[Tue May 05 07:50:11.679346 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.94:24675] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "afkws4vmnRMz9gRzix25PQAAAAU"]
[Tue May 05 07:50:13.639510 2026] [:error] [pid 39071:tid 39095] [client 45.86.200.52:42409] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "afkwtYvmnRMz9gRzix25cQAAAA8"]
[Tue May 05 07:50:15.321826 2026] [:error] [pid 39073:tid 39149] [client 45.86.200.58:42043] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "afkwt_0kT1BNjk46BkeGZAAAAI8"]
[Tue May 05 07:50:15.869413 2026] [:error] [pid 39178:tid 39194] [client 45.86.200.112:23749] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "afkwtzaPrgTaiOD_15vOBwAAAM4"]
[Tue May 05 07:50:17.697694 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.58:25675] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "afkwuf0kT1BNjk46BkeGpgAAAIo"]
[Tue May 05 07:50:18.815295 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.52:44961] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/install.php"] [unique_id "afkwunG_NPOxSH0O9aRAVAAAAUY"]
[Tue May 05 07:50:24.136458 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.76:38821] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "afkwwP0kT1BNjk46BkeHVgAAAJM"]
[Tue May 05 07:50:27.422683 2026] [:error] [pid 39071:tid 39091] [client 45.86.200.53:32967] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/category-double.php"] [unique_id "afkww4vmnRMz9gRzix264gAAAAs"]
[Tue May 05 07:50:28.709160 2026] [:error] [pid 39178:tid 39181] [client 45.86.200.106:65143] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/db.php"] [unique_id "afkwxDaPrgTaiOD_15vPKgAAAME"]
[Tue May 05 07:50:29.243135 2026] [:error] [pid 39071:tid 39100] [client 45.86.200.106:20375] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "afkwxYvmnRMz9gRzix27EwAAABQ"]
[Tue May 05 07:50:35.429008 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.91:30987] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "afkwy_olSHl4aAnrIotNOwAAAEk"]
[Tue May 05 07:50:43.345573 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.92:25475] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "afkw0zaPrgTaiOD_15vP8QAAANQ"]
[Tue May 05 07:50:45.316262 2026] [:error] [pid 39071:tid 39086] [client 45.86.200.76:56739] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "afkw1YvmnRMz9gRzix284wAAAAY"]
[Tue May 05 07:50:46.423281 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.107:54569] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "afkw1iepFwKgA_SKOHgzdwAAAQc"]
[Tue May 05 07:50:47.513245 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.87:23895] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "afkw13G_NPOxSH0O9aRGJgAAAVQ"]
[Tue May 05 07:50:48.349093 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.108:42939] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/as.php"] [unique_id "afkw2P0kT1BNjk46BkeKBgAAAIw"]
[Tue May 05 07:50:49.166819 2026] [:error] [pid 39072:tid 39131] [client 45.86.200.109:59719] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "afkw2folSHl4aAnrIotOuAAAAFg"]
[Tue May 05 07:50:50.748188 2026] [:error] [pid 39073:tid 39152] [client 45.86.200.56:37149] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/install.php"] [unique_id "afkw2v0kT1BNjk46BkeKKQAAAJI"]
[Tue May 05 07:50:52.396660 2026] [:error] [pid 39073:tid 39152] [client 45.86.200.60:20839] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/db.php"] [unique_id "afkw3P0kT1BNjk46BkeKWwAAAJI"]
[Tue May 05 07:50:54.764190 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.73:57889] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "afkw3volSHl4aAnrIotPRwAAAEw"]
[Tue May 05 07:50:56.111755 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.86:29983] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rk2.php"] [unique_id "afkw4CepFwKgA_SKOHg0gQAAAQA"]
[Tue May 05 07:50:57.206357 2026] [:error] [pid 39071:tid 39093] [client 45.86.200.108:34857] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "afkw4YvmnRMz9gRzix2-JgAAAA0"]
[Tue May 05 07:50:58.354046 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.73:55343] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "afkw4v0kT1BNjk46BkeLAgAAAJM"]
[Tue May 05 07:51:00.295503 2026] [:error] [pid 39072:tid 39126] [client 45.86.200.89:31375] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "afkw5PolSHl4aAnrIotP0gAAAFM"]
[Tue May 05 07:51:01.124097 2026] [:error] [pid 41055:tid 41062] [client 45.86.200.56:61441] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "afkw5SepFwKgA_SKOHg0-gAAAQQ"]
[Tue May 05 07:51:01.963606 2026] [:error] [pid 39073:tid 39145] [client 45.86.200.93:64329] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "afkw5f0kT1BNjk46BkeLaAAAAIs"]
[Tue May 05 07:51:03.179166 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.57:47293] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "afkw53G_NPOxSH0O9aRJfQAAAUQ"]
[Tue May 05 07:51:05.909685 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.104:59109] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "afkw6YvmnRMz9gRzix2_KwAAAAU"]
[Tue May 05 07:51:06.447340 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.51:33209] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "afkw6nG_NPOxSH0O9aRKTwAAAUY"]
[Tue May 05 07:51:07.837142 2026] [:error] [pid 39073:tid 39158] [client 45.86.200.108:43125] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "afkw6_0kT1BNjk46BkeMJgAAAJg"]
[Tue May 05 07:51:08.418253 2026] [:error] [pid 39178:tid 39204] [client 45.86.200.91:50207] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "afkw7DaPrgTaiOD_15vSdAAAANg"]
[Tue May 05 07:51:09.570435 2026] [:error] [pid 39178:tid 39196] [client 45.86.200.109:37189] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "afkw7TaPrgTaiOD_15vSmgAAANA"]
[Tue May 05 07:51:10.151438 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.109:55727] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ms-file.php"] [unique_id "afkw7volSHl4aAnrIotQsgAAAEE"]
[Tue May 05 07:51:10.694423 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.93:21263] [client 45.86.200.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "afkw7jaPrgTaiOD_15vSwwAAANQ"]
[Tue May 05 07:51:10.709509 2026] [proxy_fcgi:error] [pid 39178:tid 39200] [client 45.86.200.93:21263] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:10.981254 2026] [:error] [pid 39178:tid 39188] [client 45.86.200.93:21263] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "afkw7jaPrgTaiOD_15vSzQAAAMg"]
[Tue May 05 07:51:12.091622 2026] [:error] [pid 41055:tid 41074] [client 45.86.200.53:47113] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "afkw8CepFwKgA_SKOHg1wQAAARA"]
[Tue May 05 07:51:12.653566 2026] [:error] [pid 39071:tid 39093] [client 45.86.200.74:54469] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/network.php"] [unique_id "afkw8IvmnRMz9gRzix2_1wAAAA0"]
[Tue May 05 07:51:15.129206 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.93:65035] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "afkw8_0kT1BNjk46BkeNLwAAAIo"]
[Tue May 05 07:51:15.658300 2026] [:error] [pid 39071:tid 39103] [client 45.86.200.100:53473] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "afkw84vmnRMz9gRzix3AJQAAABc"]
[Tue May 05 07:51:16.737974 2026] [:error] [pid 39073:tid 39135] [client 45.86.200.106:56983] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "afkw9P0kT1BNjk46BkeNYgAAAIE"]
[Tue May 05 07:51:17.272185 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.111:54693] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/install.php"] [unique_id "afkw9folSHl4aAnrIotRhQAAAEI"]
[Tue May 05 07:51:17.819300 2026] [proxy_fcgi:error] [pid 41055:tid 41077] [client 45.86.200.92:29085] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:18.107358 2026] [:error] [pid 41055:tid 41063] [client 45.86.200.92:29085] [client 45.86.200.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.92, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "afkw9iepFwKgA_SKOHg2dAAAAQU"]
[Tue May 05 07:51:18.660178 2026] [:error] [pid 41055:tid 41076] [client 45.86.200.92:29085] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "afkw9iepFwKgA_SKOHg2iQAAARI"]
[Tue May 05 07:51:20.024761 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.87:45419] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "afkw-HG_NPOxSH0O9aRMSAAAAUc"]
[Tue May 05 07:51:21.840737 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.85:49541] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "afkw-XG_NPOxSH0O9aRMewAAAU0"]
[Tue May 05 07:51:22.387846 2026] [:error] [pid 39072:tid 39120] [client 45.86.200.101:60039] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "afkw-volSHl4aAnrIotSQQAAAE0"]
[Tue May 05 07:51:24.774753 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.78:54025] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "afkw_HG_NPOxSH0O9aRMyQAAAUU"]
[Tue May 05 07:51:25.889265 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.51:56211] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "afkw_TaPrgTaiOD_15vURAAAAMM"]
[Tue May 05 07:51:28.607769 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.87:22619] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "afkxAHG_NPOxSH0O9aRNRAAAAVE"]
[Tue May 05 07:51:29.149731 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.95:20971] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/bypass.php"] [unique_id "afkxAfolSHl4aAnrIotTCwAAAEk"]
[Tue May 05 07:51:29.967426 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.100:46495] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/count.php"] [unique_id "afkxAXG_NPOxSH0O9aRNgQAAAUE"]
[Tue May 05 07:51:32.213746 2026] [:error] [pid 39178:tid 39191] [client 45.86.200.58:39091] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "afkxBDaPrgTaiOD_15vVAQAAAMs"]
[Tue May 05 07:51:34.336722 2026] [:error] [pid 39073:tid 39147] [client 45.86.200.90:26577] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com"] [uri "/images/stories/themes.php"] [unique_id "afkxBv0kT1BNjk46BkePwgAAAI0"]
[Tue May 05 07:51:34.603730 2026] [:error] [pid 39073:tid 39148] [client 45.86.200.90:26577] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "afkxBv0kT1BNjk46BkePywAAAI4"]
[Tue May 05 07:51:35.719167 2026] [:error] [pid 39178:tid 39188] [client 45.86.200.58:62751] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "afkxBzaPrgTaiOD_15vVewAAAMg"]
[Tue May 05 07:51:36.294965 2026] [:error] [pid 41055:tid 41062] [client 45.86.200.86:22747] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "afkxCCepFwKgA_SKOHg4-gAAAQQ"]
[Tue May 05 07:51:43.372910 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.93:60409] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "afkxD3G_NPOxSH0O9aRPBQAAAUQ"]
[Tue May 05 07:51:44.459520 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.98:46305] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "afkxECepFwKgA_SKOHg55wAAAQ0"]
[Tue May 05 07:51:45.294958 2026] [:error] [pid 39071:tid 39091] [client 45.86.200.103:36427] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "afkxEYvmnRMz9gRzix3DFQAAAAs"]
[Tue May 05 07:51:47.212559 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.74:37887] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "afkxE3G_NPOxSH0O9aRPfAAAAVQ"]
[Tue May 05 07:51:47.790099 2026] [:error] [pid 39071:tid 39102] [client 45.86.200.106:28351] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/colour.php"] [unique_id "afkxE4vmnRMz9gRzix3DSAAAABY"]
[Tue May 05 07:51:48.607958 2026] [:error] [pid 39073:tid 39141] [client 45.86.200.54:49475] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "afkxFP0kT1BNjk46BkeRUwAAAIc"]
[Tue May 05 07:51:49.147431 2026] [:error] [pid 39178:tid 39187] [client 45.86.200.86:54787] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/include.php"] [unique_id "afkxFTaPrgTaiOD_15vXPwAAAMc"]
[Tue May 05 07:51:50.243648 2026] [:error] [pid 39071:tid 39086] [client 45.86.200.53:51575] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "afkxFovmnRMz9gRzix3DdwAAAAY"]
[Tue May 05 07:51:51.344302 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.107:56211] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "afkxF3G_NPOxSH0O9aRP7wAAAU4"]
[Tue May 05 07:51:51.876300 2026] [:error] [pid 39071:tid 39081] [client 45.86.200.107:40697] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "afkxF4vmnRMz9gRzix3DoQAAAAE"]
[Tue May 05 07:51:53.511158 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.91:21187] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "afkxGfolSHl4aAnrIotWqQAAAEk"]
[Tue May 05 07:51:54.681736 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.51:50261] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "afkxGnG_NPOxSH0O9aRQVwAAAUU"]
[Tue May 05 07:51:56.085265 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.51:53571] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "afkxHPolSHl4aAnrIotW_wAAAEk"]
[Tue May 05 07:51:56.623402 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.57:35903] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "afkxHPolSHl4aAnrIotXEwAAAEQ"]
[Tue May 05 07:52:32.400942 2026] [autoindex:error] [pid 39072:tid 39126] [client 45.86.200.111:40867] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 11:38:25.833136 2026] [:error] [pid 25743:tid 25770] [client 43.166.244.251:53268] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aflmMW-PCMRhF5DdUnN06wAAABc"]
[Tue May 05 14:24:44.529685 2026] [:error] [pid 25743:tid 25765] [client 43.167.241.46:33822] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afmNLG-PCMRhF5DdUnOUpwAAABI"]
[Tue May 05 17:10:43.986693 2026] [:error] [pid 25743:tid 25771] [client 43.166.1.243:41526] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afm0E2-PCMRhF5DdUnOv_QAAABg"]
[Tue May 05 19:42:51.940010 2026] [:error] [pid 25745:tid 25817] [client 163.172.83.95:49538] [client 163.172.83.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "afnXu5sd7hb7vrvCNBlFEgAAANA"]
[Tue May 05 19:42:55.183007 2026] [:error] [pid 25743:tid 25763] [client 163.172.83.95:56488] [client 163.172.83.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "afnXv2-PCMRhF5DdUnPWTQAAABA"]
[Tue May 05 22:06:51.054601 2026] [:error] [pid 25743:tid 25764] [client 49.51.243.95:56610] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afn5e2-PCMRhF5DdUnMAgwAAABE"]
[Tue May 05 22:14:58.968674 2026] [:error] [pid 25743:tid 25770] [client 194.62.107.135:51417] [client 194.62.107.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "afn7Ym-PCMRhF5DdUnMCYgAAABc"]
[Wed May 06 06:18:28.491494 2026] [:error] [pid 48867:tid 48879] [client 52.182.172.157:49683] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "afpstFZQ-8ZcCbMZPy4ROQAAAMk"]
[Wed May 06 06:19:03.561137 2026] [:error] [pid 48757:tid 48767] [client 52.182.172.157:15196] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afps10AivC3C614LoA5rGQAAAAE"]
[Wed May 06 06:19:04.903743 2026] [:error] [pid 48757:tid 48786] [client 52.182.172.157:14514] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "afps2EAivC3C614LoA5rGwAAABQ"]
[Wed May 06 06:19:07.348856 2026] [:error] [pid 48867:tid 48879] [client 52.182.172.157:51849] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "afps21ZQ-8ZcCbMZPy4RXwAAAMk"]
[Wed May 06 06:19:09.457552 2026] [:error] [pid 48757:tid 48775] [client 52.182.172.157:15275] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "afps3UAivC3C614LoA5rIQAAAAk"]
[Wed May 06 06:19:11.889007 2026] [proxy_fcgi:error] [pid 33660:tid 33674] [client 52.182.172.157:53838] AH01071: Got error 'Primary script unknown'
[Wed May 06 06:19:15.481202 2026] [:error] [pid 33660:tid 33665] [client 52.182.172.157:53838] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/assets/index.php"] [unique_id "afps4_6jj6Ce_ERq7qN3HwAAAQM"]
[Wed May 06 06:19:21.812123 2026] [:error] [pid 33660:tid 33669] [client 52.182.172.157:14497] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "afps6f6jj6Ce_ERq7qN3QQAAAQc"]
[Wed May 06 06:19:24.596886 2026] [:error] [pid 48759:tid 48827] [client 52.182.172.157:49712] [client 52.182.172.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "afps7KmcftH9JrQl_yHUbQAAAIU"]
[Wed May 06 09:57:27.952142 2026] [:error] [pid 13414:tid 13434] [client 138.204.210.183:38933] [client 138.204.210.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.204.210.183, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afqgB0uJQpWjVpJTu_nk8gAAARI"]
[Wed May 06 11:28:42.023152 2026] [:error] [pid 63810:tid 63826] [client 170.64.226.45:52447] [client 170.64.226.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.226.45, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "afq1anpnbsN9Zf6i5IEbBQAAAYw"]
[Wed May 06 11:28:42.095658 2026] [:error] [pid 13443:tid 13447] [client 170.64.226.45:52450] [client 170.64.226.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.226.45, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "afq1agCyfZallDmsQrd4EwAAAUI"]
[Wed May 06 12:35:16.582539 2026] [:error] [pid 482:tid 501] [client 43.159.145.153:45034] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afrFBMxs8HOc_nWgOW7aHwAAAdE"]
[Wed May 06 13:54:12.611146 2026] [:error] [pid 482:tid 504] [client 62.228.157.145:13608] [client 62.228.157.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "afrXhMxs8HOc_nWgOW71awAAAdQ"]
[Wed May 06 13:54:14.179568 2026] [:error] [pid 482:tid 501] [client 62.228.157.145:18782] [client 62.228.157.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "afrXhsxs8HOc_nWgOW71cQAAAdE"]
[Wed May 06 18:18:26.339413 2026] [:error] [pid 9659:tid 9737] [client 43.135.182.95:47474] [client 43.135.182.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afsVcvwJnWjd8JHpBtuBQAAAAMM"]
[Wed May 06 21:00:58.555630 2026] [:error] [pid 9789:tid 9810] [client 43.130.139.177:49148] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afs7ij_YStPJSCHPkUWWDAAAAFM"]
[Wed May 06 23:24:32.011051 2026] [:error] [pid 482:tid 498] [client 124.156.157.91:35080] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aftdMMxs8HOc_nWgOW50SQAAAc4"]
[Thu May 07 02:19:57.270133 2026] [:error] [pid 9664:tid 9763] [client 43.159.143.187:41744] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afuGTQH4OZbrg1SjsBOC0wAAAIE"]
[Thu May 07 05:39:49.619599 2026] [:error] [pid 29606:tid 29645] [client 43.133.69.37:58700] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afu1JRR5HjZ1PlSAiKtkLgAAAEQ"]
[Thu May 07 06:28:03.056115 2026] [:error] [pid 29710:tid 29720] [client 34.42.103.3:51424] [client 34.42.103.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "afvAc_0atTQld9Y2ht_zNAAAAMg"]
[Thu May 07 07:23:24.526427 2026] [:error] [pid 29607:tid 29691] [client 52.161.177.65:49207] [client 52.161.177.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.161.177.65, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/wp/xmlrpc.php"] [unique_id "afvNbKbP7TJOAh7WSUOLRQAAAJc"]
[Thu May 07 11:28:02.971509 2026] [:error] [pid 1143:tid 1150] [client 129.226.174.80:37496] [client 129.226.174.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afwGwpb7qeI8X5VYRr5g6wAAAQU"]
[Thu May 07 13:55:45.165070 2026] [:error] [pid 56066:tid 56141] [client 195.178.110.241:55682] [client 195.178.110.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "afwpYUYS8DGwDvklLv7D8gAAANI"]
[Thu May 07 14:24:41.102565 2026] [:error] [pid 15630:tid 15672] [client 170.106.192.3:47386] [client 170.106.192.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afwwKXTithRAi4821qt_7AAAAIw"]
[Thu May 07 17:26:35.740630 2026] [:error] [pid 28098:tid 28120] [client 162.62.213.187:48154] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "afxay8vhwfljlt8trSq1YwAAAFQ"]
[Thu May 07 17:50:14.369140 2026] [:error] [pid 28098:tid 28118] [client 106.54.62.156:58378] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afxgVsvhwfljlt8trSq-dQAAAFI"]
[Thu May 07 17:58:34.881063 2026] [:error] [pid 28098:tid 28106] [client 151.243.143.47:57658] [client 151.243.143.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "afxiSsvhwfljlt8trSrAvQAAAEY"]
[Thu May 07 17:58:34.916471 2026] [:error] [pid 28098:tid 28122] [client 151.243.143.47:57662] [client 151.243.143.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "afxiSsvhwfljlt8trSrAvgAAAFY"]
[Thu May 07 20:02:49.288943 2026] [:error] [pid 15629:tid 15646] [client 43.157.20.63:35146] [client 43.157.20.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afx_afrIJCALdUrO43l47AAAAA0"]
[Thu May 07 21:30:29.200951 2026] [:error] [pid 15631:tid 15688] [client 20.116.58.144:24573] [client 20.116.58.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "afyT9XvP1GkPUuuLfqVLQQAAAME"]
[Thu May 07 21:30:31.192463 2026] [:error] [pid 28098:tid 28120] [client 20.116.58.144:24555] [client 20.116.58.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/120f9.php"] [unique_id "afyT98vhwfljlt8trSoKkgAAAFQ"]
[Thu May 07 21:30:32.429223 2026] [:error] [pid 28098:tid 28101] [client 20.116.58.144:24549] [client 20.116.58.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/sitemaps/admin.php"] [unique_id "afyT-Mvhwfljlt8trSoKlgAAAEE"]
[Thu May 07 21:30:33.374377 2026] [:error] [pid 28098:tid 28121] [client 20.116.58.144:24466] [client 20.116.58.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/customize/about.php"] [unique_id "afyT-cvhwfljlt8trSoKmwAAAFU"]
[Thu May 07 21:30:44.447129 2026] [:error] [pid 15629:tid 15636] [client 20.116.58.144:24456] [client 20.116.58.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afyUBPrIJCALdUrO43mC4gAAAAM"]
[Thu May 07 21:32:15.112049 2026] [:error] [pid 15631:tid 15711] [client 20.116.58.144:24517] [client 20.116.58.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afyUX3vP1GkPUuuLfqVMLwAAANg"]
[Thu May 07 22:38:34.156469 2026] [:error] [pid 15629:tid 15639] [client 196.206.123.211:51968] [client 196.206.123.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.206.123.211, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "afyj6vrIJCALdUrO43mNgQAAAAY"]
[Fri May 08 01:24:26.434623 2026] [:error] [pid 12323:tid 12344] [client 43.165.126.130:43318] [client 43.165.126.130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "afzKytdhHMnGFpc7MDxIVAAAAVE"]
[Fri May 08 05:11:30.073869 2026] [:error] [pid 51009:tid 51090] [client 43.157.179.227:47500] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af0AAuB0GbUWhxgzX9WRRAAAAI4"]
[Fri May 08 05:48:32.149183 2026] [:error] [pid 34318:tid 34332] [client 34.32.7.127:43212] [client 34.32.7.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "af0IsMr3guirgJiKhzBeVQAAAQw"]
[Fri May 08 08:25:46.759989 2026] [:error] [pid 61356:tid 61391] [client 43.153.71.12:35328] [client 43.153.71.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "af0tiox3vpB8oWhUq2OjcQAAAcM"]
[Fri May 08 09:02:00.161858 2026] [:error] [pid 51113:tid 51124] [client 20.63.32.193:8414] [client 20.63.32.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/archive.php"] [unique_id "af02CEQfs7sWtqkpQIc-2wAAAMk"]
[Fri May 08 09:02:01.744714 2026] [:error] [pid 51007:tid 51027] [client 20.63.32.193:8803] [client 20.63.32.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/archive.php"] [unique_id "af02CVMagSGstWKyzzWcdwAAAAU"]
[Fri May 08 09:02:03.074774 2026] [:error] [pid 51007:tid 51040] [client 20.63.32.193:8421] [client 20.63.32.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/archive.php"] [unique_id "af02C1MagSGstWKyzzWcfgAAABI"]
[Fri May 08 09:02:04.111526 2026] [:error] [pid 51007:tid 51028] [client 20.63.32.193:8776] [client 20.63.32.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/archive.php"] [unique_id "af02DFMagSGstWKyzzWchwAAAAY"]
[Fri May 08 11:02:39.608416 2026] [:error] [pid 51009:tid 51089] [client 34.35.123.193:41714] [client 34.35.123.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "af1ST-B0GbUWhxgzX9XIqgAAAI0"]
[Fri May 08 11:25:21.039453 2026] [:error] [pid 61356:tid 61397] [client 43.130.40.120:45638] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af1XoYx3vpB8oWhUq2PiPwAAAck"]
[Fri May 08 17:18:27.696838 2026] [:error] [pid 51007:tid 51022] [client 43.166.237.57:35756] [client 43.166.237.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af2qY1MagSGstWKyzzXSBQAAAAA"]
[Fri May 08 22:36:41.648825 2026] [:error] [pid 61355:tid 61380] [client 43.153.85.46:58746] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af30-fkhJTi30CBXmMnZmAAAAZM"]
[Sat May 09 01:31:03.260731 2026] [:error] [pid 61356:tid 61390] [client 34.254.154.62:46704] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "af4d14x3vpB8oWhUq2Mm4QAAAcI"]
[Sat May 09 01:31:04.639594 2026] [:error] [pid 61356:tid 61404] [client 34.254.154.62:46730] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4d2Ix3vpB8oWhUq2Mm5AAAAdA"]
[Sat May 09 01:31:26.086381 2026] [:error] [pid 51113:tid 51136] [client 34.254.154.62:42126] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/phpinfo.php.bak"] [unique_id "af4d7kQfs7sWtqkpQIea4gAAANU"]
[Sat May 09 01:31:26.347446 2026] [:error] [pid 51113:tid 51125] [client 34.254.154.62:42126] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/phpinfo.php.old"] [unique_id "af4d7kQfs7sWtqkpQIea4wAAAMo"]
[Sat May 09 01:31:27.129071 2026] [:error] [pid 51113:tid 51139] [client 34.254.154.62:42126] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com"] [uri "/info.php.bak"] [unique_id "af4d70Qfs7sWtqkpQIea5QAAANg"]
[Sat May 09 02:45:48.243330 2026] [:error] [pid 51008:tid 51049] [client 170.106.187.106:46570] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "af4vXHB58C2Y1tgLtuLuMgAAAEA"]
[Sat May 09 04:00:18.713492 2026] [:error] [pid 9184:tid 9219] [client 45.92.229.139:56521] [client 45.92.229.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.229.139, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "af5A0ojfODqb_i0Fm99KkwAAABY"]
[Sat May 09 04:59:33.736119 2026] [:error] [pid 9187:tid 9254] [client 34.254.154.62:33736] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "af5OtRC7An6gkXsRsaHTogAAAIE"]
[Sat May 09 04:59:35.023360 2026] [:error] [pid 9663:tid 9677] [client 34.254.154.62:33770] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "af5Ot5cWIu01SCxbjwu8qQAAAQs"]
[Sat May 09 12:43:56.493851 2026] [:error] [pid 9920:tid 9936] [client 43.167.236.228:48380] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "af67jExitGYhlzgZb5a_MwAAAc4"]
[Sat May 09 14:09:42.771315 2026] [:error] [pid 9293:tid 9305] [client 20.206.86.59:20852] [client 20.206.86.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.206.86.59, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "af7PppR__qEzV5O6Z2OI9QAAAMg"]
[Sat May 09 14:09:45.620402 2026] [:error] [pid 9293:tid 9313] [client 20.206.86.59:20852] [client 20.206.86.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.206.86.59, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "af7PqZR__qEzV5O6Z2OI_wAAANA"]
[Sat May 09 14:09:50.320138 2026] [:error] [pid 9293:tid 9301] [client 20.206.86.59:20852] [client 20.206.86.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "af7PrpR__qEzV5O6Z2OJDgAAAMQ"]
[Sat May 09 16:19:34.183212 2026] [:error] [pid 9187:tid 9274] [client 170.106.37.134:38282] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af7uFhC7An6gkXsRsaGr2QAAAJU"]
[Sat May 09 16:27:54.242968 2026] [:error] [pid 9186:tid 9238] [client 172.71.144.148:13067] [client 172.71.144.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "af7wChW4eFOEw1mKOgLaHQAAAEw"]
[Sat May 09 16:59:31.920088 2026] [:error] [pid 9920:tid 9928] [client 95.141.213.135:2379] [client 95.141.213.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.141.213.135, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "af73c0xitGYhlzgZb5b0mgAAAcY"]
[Sat May 09 19:24:10.554767 2026] [:error] [pid 9920:tid 9929] [client 43.138.68.113:39802] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "af8ZWkxitGYhlzgZb5YQ_gAAAcc"]
[Sat May 09 22:14:02.632116 2026] [:error] [pid 55191:tid 55292] [client 170.106.163.84:49784] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af9BKvMcqx1kfQsw7c4TLQAAAI8"]
[Sun May 10 02:00:13.318526 2026] [:error] [pid 55182:tid 55216] [client 43.166.136.24:53838] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "af92LTaxmP-S8ASrqQn74gAAAMQ"]
[Sun May 10 02:32:26.052019 2026] [:error] [pid 62831:tid 62854] [client 34.97.211.209:48028] [client 34.97.211.209] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "af99uuYBNqNhtZ_l7qB5rwAAABU"]
[Sun May 10 05:26:46.119804 2026] [:error] [pid 62910:tid 62936] [client 85.11.167.118:41600] [client 85.11.167.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.11.167.118, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "af-mlt5YAy_h5VqgWqhXyAAAANg"]
[Sun May 10 08:22:14.413574 2026] [:error] [pid 46331:tid 46377] [client 43.138.68.113:33972] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "af_PtgP02hpYETwsZpgSvgAAAIk"]
[Sun May 10 11:03:36.722671 2026] [:error] [pid 46329:tid 46350] [client 43.153.36.110:57330] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "af_1iOFo7Z2I88d0gPJf6wAAABE"]
[Sun May 10 13:30:21.941751 2026] [:error] [pid 46331:tid 46399] [client 154.54.100.175:44856] [client 154.54.100.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/HEAD"] [unique_id "agAX7QP02hpYETwsZpg1JQAAAJQ"]
[Sun May 10 19:26:21.187927 2026] [:error] [pid 37030:tid 37049] [client 91.73.107.236:26264] [client 91.73.107.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.73.107.236, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agBrXZrBzfXWwKkDkdaKWAAAANE"]
[Sun May 10 23:56:07.830435 2026] [:error] [pid 16136:tid 16144] [client 43.157.179.227:44008] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agCql0OBGdmCMnPX0McYswAAAIY"]
[Mon May 11 03:13:03.345844 2026] [:error] [pid 16038:tid 16072] [client 45.154.98.150:64265] [client 45.154.98.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.154.98.150, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agDYv04hf5Tcsfa2scKO8gAAAYQ"]
[Mon May 11 03:13:07.760148 2026] [:error] [pid 16038:tid 16087] [client 45.154.98.150:49318] [client 45.154.98.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.154.98.150, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agDYw04hf5Tcsfa2scKPDQAAAZM"]
[Mon May 11 04:11:36.104899 2026] [:error] [pid 65366:tid 65371] [client 34.159.149.110:43160] [client 34.159.149.110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "agDmeKhVGdYzapDtv-HWIwAAAMM"]
[Mon May 11 06:19:47.497267 2026] [:error] [pid 65366:tid 65374] [client 165.140.202.17:50368] [client 165.140.202.17] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agEEg6hVGdYzapDtv-Hx6wAAAMY"]
[Mon May 11 06:19:47.523890 2026] [:error] [pid 65260:tid 65298] [client 165.140.202.17:50390] [client 165.140.202.17] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/HEAD"] [unique_id "agEEgzqbzwIHjP6Y_3F1fgAAAEI"]
[Mon May 11 07:11:16.813985 2026] [:error] [pid 65366:tid 65380] [client 43.130.110.130:56354] [client 43.130.110.130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agEQlKhVGdYzapDtv-H6gQAAAMs"]
[Mon May 11 09:12:56.111914 2026] [:error] [pid 65259:tid 65275] [client 34.47.42.70:53332] [client 34.47.42.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agEtGAPsXLnMa32ma5BiLAAAAAc"]
[Mon May 11 13:55:07.699399 2026] [:error] [pid 65259:tid 65278] [client 43.135.144.81:46744] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agFvOwPsXLnMa32ma5B5gAAAAAo"]
[Mon May 11 15:17:18.862517 2026] [:error] [pid 4685:tid 4693] [client 34.39.95.51:49856] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.docker"] [unique_id "agGCfnwrjbU4NZilCZ-r3gAAAQU"]
[Mon May 11 15:17:18.870480 2026] [:error] [pid 4685:tid 4707] [client 34.39.95.51:49862] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/admin/.env"] [unique_id "agGCfnwrjbU4NZilCZ-r3wAAARM"]
[Mon May 11 15:17:19.287878 2026] [:error] [pid 4685:tid 4705] [client 34.39.95.51:56756] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.development.local"] [unique_id "agGCf3wrjbU4NZilCZ-r4QAAARE"]
[Mon May 11 15:17:19.434779 2026] [:error] [pid 58616:tid 58661] [client 34.39.95.51:56778] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.local"] [unique_id "agGCf9nsbeF5ioCAecjS5QAAAM8"]
[Mon May 11 15:17:19.451152 2026] [:error] [pid 4685:tid 4704] [client 34.39.95.51:56768] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/app/.env"] [unique_id "agGCf3wrjbU4NZilCZ-r4wAAARA"]
[Mon May 11 15:17:19.452250 2026] [:error] [pid 4685:tid 4695] [client 34.39.95.51:56788] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.dev"] [unique_id "agGCf3wrjbU4NZilCZ-r5AAAAQc"]
[Mon May 11 15:17:19.470871 2026] [:error] [pid 4685:tid 4699] [client 34.39.95.51:56802] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "agGCf3wrjbU4NZilCZ-r5QAAAQs"]
[Mon May 11 15:17:19.783528 2026] [:error] [pid 4685:tid 4694] [client 34.39.95.51:56816] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/api/.env"] [unique_id "agGCf3wrjbU4NZilCZ-r5gAAAQY"]
[Mon May 11 15:17:19.881938 2026] [:error] [pid 4685:tid 4697] [client 34.39.95.51:56826] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/app/.env.local"] [unique_id "agGCf3wrjbU4NZilCZ-r5wAAAQk"]
[Mon May 11 15:17:20.138877 2026] [:error] [pid 4685:tid 4701] [client 34.39.95.51:56836] [client 34.39.95.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env.dev.local"] [unique_id "agGCgHwrjbU4NZilCZ-r6AAAAQ0"]
[Mon May 11 15:17:48.647755 2026] [:error] [pid 4645:tid 4666] [client 34.162.207.34:56334] [client 34.162.207.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agGCnHy4dxn8-Cx5vOWE_AAAAFI"]
[Mon May 11 15:47:41.979575 2026] [:error] [pid 4685:tid 4708] [client 117.212.42.166:62406] [client 117.212.42.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.212.42.166, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agGJnXwrjbU4NZilCZ-3SgAAARQ"]
[Mon May 11 17:00:01.193796 2026] [:error] [pid 4685:tid 4704] [client 94.247.172.129:65143] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agGakXwrjbU4NZilCZ_JVgAAARA"]
[Mon May 11 19:55:17.738689 2026] [:error] [pid 58677:tid 58711] [client 119.28.89.249:53602] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agHDpRasRhyteIXf1RVjaQAAAJc"]
[Mon May 11 21:08:00.748513 2026] [:error] [pid 4645:tid 4671] [client 119.91.20.139:36968] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agHUsHy4dxn8-Cx5vOXBqwAAAFc"]
[Mon May 11 21:46:13.662618 2026] [:error] [pid 4685:tid 4706] [client 43.166.128.187:47638] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agHdpXwrjbU4NZilCZ8RLwAAARI"]
[Tue May 12 02:10:09.768500 2026] [:error] [pid 58616:tid 58652] [client 20.198.217.193:38020] [client 20.198.217.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.198.217.193, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agIbgdnsbeF5ioCAecgFmwAAAMY"]
[Tue May 12 02:10:43.593503 2026] [:error] [pid 4685:tid 4689] [client 20.198.217.193:39240] [client 20.198.217.193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paramountestate.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agIbo3wrjbU4NZilCZ9GewAAAQE"]
[Tue May 12 02:11:08.526780 2026] [:error] [pid 58615:tid 58641] [client 20.198.217.193:33016] [client 20.198.217.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.198.217.193, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agIbvFK28yH055J8TSoEkAAAABY"]
[Tue May 12 02:11:42.200607 2026] [:error] [pid 4685:tid 4688] [client 20.198.217.193:54188] [client 20.198.217.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.198.217.193, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agIb3nwrjbU4NZilCZ9GngAAAQA"]
[Tue May 12 04:14:42.684792 2026] [:error] [pid 39957:tid 40007] [client 43.160.240.216:55572] [client 43.160.240.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agI4suAfHHyq0DBh5BLu1QAAAE8"]
[Tue May 12 04:20:43.137446 2026] [:error] [pid 39958:tid 40033] [client 176.65.139.235:47204] [client 176.65.139.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "agI6G-VI9FVDxXB2XxgeIQAAAI4"]
[Tue May 12 08:13:05.416016 2026] [:error] [pid 39957:tid 39996] [client 43.159.46.41:60016] [client 43.159.46.41] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agJwkeAfHHyq0DBh5BIFKgAAAEQ"]
[Tue May 12 09:46:28.348506 2026] [:error] [pid 55559:tid 55636] [client 43.140.247.223:38130] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agKGdNj0hVMLJAOI_fxyLAAAARA"]
[Tue May 12 10:15:16.798126 2026] [:error] [pid 39957:tid 40006] [client 43.165.4.2:38322] [client 43.165.4.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agKNNOAfHHyq0DBh5BIaDwAAAE4"]
[Tue May 12 12:04:38.194763 2026] [:error] [pid 39957:tid 40002] [client 50.121.109.173:56305] [client 50.121.109.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.121.109.173, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agKm1uAfHHyq0DBh5BIt-AAAAEo"]
[Tue May 12 13:53:55.447845 2026] [:error] [pid 39957:tid 39999] [client 88.130.71.133:63390] [client 88.130.71.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.130.71.133, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agLAc-AfHHyq0DBh5BJINgAAAEc"]
[Tue May 12 21:45:42.251708 2026] [:error] [pid 21242:tid 21267] [client 43.163.5.216:56582] [client 43.163.5.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agMvBszeh8JWZob6PnIXyAAAAZU"]
[Tue May 12 21:57:49.566087 2026] [:error] [pid 21242:tid 21250] [client 122.51.236.174:55488] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agMx3czeh8JWZob6PnIZlQAAAYQ"]
[Tue May 12 23:35:30.101151 2026] [:error] [pid 39957:tid 40008] [client 43.165.7.74:56582] [client 43.165.7.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agNIwuAfHHyq0DBh5BKajgAAAFA"]
[Wed May 13 01:31:55.100293 2026] [:error] [pid 42143:tid 42151] [client 43.163.206.70:47738] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agNkC0S2WmK92iCO2L1RFgAAAUQ"]
[Wed May 13 03:52:30.005693 2026] [:error] [pid 20602:tid 20605] [client 43.157.170.126:36134] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agOE_pkAzvwlzBg7uBqMOwAAAME"]
[Wed May 13 06:03:40.808575 2026] [:error] [pid 3259:tid 3278] [client 43.166.128.187:54118] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agOjvOWJB4YwcPVLeAp_jgAAARE"]
[Wed May 13 06:57:30.528880 2026] [:error] [pid 23887:tid 23910] [client 102.223.33.208:56447] [client 102.223.33.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.223.33.208, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agOwWtSKmvZJZkXBFDD7VQAAAM8"]
[Wed May 13 08:13:02.133969 2026] [:error] [pid 3259:tid 3285] [client 43.134.186.61:39852] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agPCDuWJB4YwcPVLeAqh7AAAARg"]
[Wed May 13 08:59:06.050318 2026] [:error] [pid 23782:tid 23841] [client 34.76.31.227:57696] [client 34.76.31.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "agPM2iBrKFYHXUGnR-qORAAAAFQ"]
[Wed May 13 09:17:46.433221 2026] [:error] [pid 3259:tid 3266] [client 216.26.242.178:57737] [client 216.26.242.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.svn/wc.db"] [unique_id "agPROuWJB4YwcPVLeAqwVgAAAQU"]
[Wed May 13 13:10:28.358020 2026] [:error] [pid 27332:tid 27334] [client 46.105.44.27:40726] [client 46.105.44.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "agQHxI6Y5F_V9bmyC4aHNAAAAUA"]
[Wed May 13 14:38:11.574682 2026] [:error] [pid 3259:tid 3261] [client 43.157.142.101:58454] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agQcU-WJB4YwcPVLeAoOWwAAAQA"]
[Wed May 13 16:47:18.052521 2026] [:error] [pid 55745:tid 55796] [client 101.32.52.164:33536] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agQ6lgzqD9WDZdTELeIFMwAAAtU"]
[Wed May 13 17:21:58.372705 2026] [:error] [pid 55745:tid 55777] [client 159.89.175.27:49224] [client 159.89.175.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com"] [uri "/wp-includes/css/modules.php"] [unique_id "agRCtgzqD9WDZdTELeIIcQAAAsI"]
[Wed May 13 17:26:33.963505 2026] [:error] [pid 23782:tid 23841] [client 159.89.175.27:46116] [client 159.89.175.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "agRDySBrKFYHXUGnR-roHAAAAFQ"]
[Wed May 13 17:42:12.958449 2026] [:error] [pid 45289:tid 45305] [client 159.89.175.27:35520] [client 159.89.175.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com"] [uri "/wp-includes/lx.php"] [unique_id "agRHdIOEpVhwFIe0NzgUWgAAAYw"]
[Wed May 13 18:31:14.923738 2026] [:error] [pid 23782:tid 23822] [client 43.156.66.8:58530] [client 43.156.66.8] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agRS8iBrKFYHXUGnR-r2VwAAAEE"]
[Wed May 13 19:24:01.473807 2026] [:error] [pid 55745:tid 55779] [client 176.65.139.234:50178] [client 176.65.139.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "agRfUQzqD9WDZdTELeIVlAAAAsQ"]
[Wed May 13 22:54:01.429557 2026] [:error] [pid 12338:tid 12386] [client 122.51.236.174:37490] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agSQicUJ87l42ffPr4wWYQAAAFE"]
[Thu May 14 02:36:54.817909 2026] [:error] [pid 17873:tid 17903] [client 43.135.133.241:54830] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agTExvEqBQQrkyEyu_o5XQAAARY"]
[Thu May 14 05:08:28.840572 2026] [:error] [pid 11582:tid 11625] [client 129.226.94.52:59930] [client 129.226.94.52] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agToTPuw2cmFDpGcKhDOJAAAAEA"]
[Thu May 14 09:24:02.966560 2026] [:error] [pid 11582:tid 11640] [client 170.106.113.235:34320] [client 170.106.113.235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agUkMvuw2cmFDpGcKhDwggAAAE8"]
[Thu May 14 11:19:43.776077 2026] [:error] [pid 11582:tid 11638] [client 170.106.163.84:60530] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agU_T_uw2cmFDpGcKhD8uwAAAE0"]
[Thu May 14 11:33:03.499756 2026] [:error] [pid 47721:tid 47740] [client 43.140.247.223:40720] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agVCb3Emh7_G0hfOa6tw2QAAAZE"]
[Thu May 14 15:10:48.995170 2026] [:error] [pid 47721:tid 47731] [client 101.33.80.42:41956] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agV1eHEmh7_G0hfOa6vYAgAAAYg"]
[Thu May 14 16:33:45.989616 2026] [:error] [pid 11582:tid 11643] [client 185.220.175.199:41734] [client 185.220.175.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.env"] [unique_id "agWI6fuw2cmFDpGcKhAlpQAAAFI"]
[Thu May 14 18:57:26.311865 2026] [:error] [pid 11690:tid 11719] [client 43.134.188.114:39024] [client 43.134.188.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agWqlinxWuLN8Hptw8knnQAAANQ"]
[Thu May 14 20:44:51.108871 2026] [:error] [pid 47721:tid 47742] [client 43.159.61.24:46580] [client 43.159.61.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agXDw3Emh7_G0hfOa6sgMAAAAZM"]
[Fri May 15 00:30:38.763387 2026] [:error] [pid 11581:tid 11613] [client 43.166.128.86:51282] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agX4rv0vF48FbzpvQMVdngAAABA"]
[Fri May 15 00:33:48.492868 2026] [:error] [pid 63033:tid 63047] [client 49.234.192.248:51132] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agX5bFMY49UWn5BpqVYTGQAAAQw"]
[Fri May 15 05:13:58.703372 2026] [:error] [pid 1188:tid 1203] [client 43.153.204.189:38170] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agY7FtY68iW8yuNkNzPHwwAAAAY"]
[Fri May 15 07:20:01.200822 2026] [:error] [pid 1295:tid 1320] [client 43.166.244.66:60272] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agZYodmMhqLvs0GYixnmfAAAANY"]
[Fri May 15 09:39:16.897194 2026] [:error] [pid 50531:tid 50555] [client 43.131.23.154:47330] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agZ5RB3WbFwE6voqGzrgyAAAARY"]
[Fri May 15 10:37:42.623270 2026] [:error] [pid 51234:tid 51244] [client 136.116.69.69:54050] [client 136.116.69.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agaG9t72N9CbeiqcqgPhawAAAUg"]
[Fri May 15 11:13:05.523679 2026] [:error] [pid 1190:tid 1255] [client 34.130.34.214:42680] [client 34.130.34.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agaPQdqiXrD7hne4gFbSeAAAAIM"]
[Fri May 15 11:47:39.671541 2026] [:error] [pid 51234:tid 51256] [client 43.165.7.74:49172] [client 43.165.7.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agaXW972N9CbeiqcqgP5FgAAAVQ"]
[Fri May 15 12:48:40.567550 2026] [:error] [pid 9392:tid 9398] [client 49.234.192.248:57950] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agalqNBWJIjH1U9zGfZ4YwAAAQQ"]
[Fri May 15 12:52:10.298828 2026] [:error] [pid 9307:tid 9367] [client 34.78.86.247:53256] [client 34.78.86.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agameiC43jY1IRzK5VYpsgAAAMI"]
[Fri May 15 13:19:28.719778 2026] [:error] [pid 9305:tid 9345] [client 34.17.65.175:35608] [client 34.17.65.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agas4N5FZyBmdCM8GsFtnQAAAEc"]
[Fri May 15 13:51:09.404730 2026] [:error] [pid 9392:tid 9407] [client 43.135.145.117:54024] [client 43.135.145.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aga0TdBWJIjH1U9zGfaTcQAAAQ0"]
[Fri May 15 13:55:04.690120 2026] [:error] [pid 9392:tid 9412] [client 34.17.111.212:57582] [client 34.17.111.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "aga1ONBWJIjH1U9zGfaUlQAAARI"]
[Fri May 15 15:32:19.718611 2026] [:error] [pid 9307:tid 9366] [client 43.134.40.189:44108] [client 43.134.40.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agbMAyC43jY1IRzK5VZFEwAAAME"]
[Fri May 15 17:30:41.828021 2026] [:error] [pid 30272:tid 30276] [client 129.226.146.42:39124] [client 129.226.146.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agbnwXvc_jSFaQ_7_wfJUAAAAYI"]
[Fri May 15 18:24:05.400739 2026] [:error] [pid 30272:tid 30294] [client 34.176.202.209:43810] [client 34.176.202.209] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "agb0RXvc_jSFaQ_7_wfWvQAAAZQ"]
[Fri May 15 21:39:23.127305 2026] [:error] [pid 9307:tid 9365] [client 189.62.10.13:49836] [client 189.62.10.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.62.10.13, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agciCyC43jY1IRzK5VZeHAAAAMA"]
[Fri May 15 22:57:43.123810 2026] [:error] [pid 30208:tid 30212] [client 129.226.146.134:54628] [client 129.226.146.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agc0Z5mLMCJujX-JTvhCJwAAAII"]
[Sat May 16 01:59:22.016413 2026] [:error] [pid 9392:tid 9395] [client 158.173.67.226:53985] [client 158.173.67.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.226, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agde-tBWJIjH1U9zGfYGSAAAAQE"]
[Sat May 16 01:59:29.018380 2026] [:error] [pid 59311:tid 59336] [client 158.173.67.166:23121] [client 158.173.67.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.166, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agdfALGBV7OkryAk5AOZIwAAApU"]
[Sat May 16 01:59:32.859785 2026] [:error] [pid 59453:tid 59460] [client 158.173.67.30:31241] [client 158.173.67.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.30, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agdfBHnXIIDivY9RkF0pPQAAA0E"]
[Sat May 16 10:12:56.510290 2026] [:error] [pid 5602:tid 5609] [client 43.159.143.187:41062] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agfSqNzTTsu77r3UIskJhgAAAQU"]
[Sat May 16 10:56:58.569975 2026] [:error] [pid 62341:tid 62352] [client 20.255.249.37:1480] [client 20.255.249.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.255.249.37, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agfc-qnvQ59ep-XG78iOFgAAAoY"]
[Sat May 16 10:56:59.740929 2026] [:error] [pid 62341:tid 62367] [client 20.255.249.37:1480] [client 20.255.249.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.255.249.37, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agfc-6nvQ59ep-XG78iOHwAAApU"]
[Sat May 16 10:57:01.278689 2026] [:error] [pid 62341:tid 62364] [client 20.255.249.37:1480] [client 20.255.249.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agfc_anvQ59ep-XG78iOKwAAApI"]
[Sat May 16 13:10:22.176827 2026] [:error] [pid 61361:tid 61387] [client 162.14.66.219:50942] [client 162.14.66.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agf8PpZojzbt3jGziNkofgAAAVg"]
[Sat May 16 16:14:48.474013 2026] [:error] [pid 24874:tid 24954] [client 43.130.174.37:55296] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aggneMiii6x3XidYGHHX0AAAAJM"]
[Sat May 16 18:18:21.062328 2026] [:error] [pid 61463:tid 61484] [client 43.162.114.69:37306] [client 43.162.114.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aghEbTXdL1WU7nYXPmTzEAAAAdM"]
[Sat May 16 20:02:18.524829 2026] [:error] [pid 61411:tid 61428] [client 43.153.26.165:44630] [client 43.153.26.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aghcymVkiEwGnPL_dvEWBwAAAY8"]
[Sat May 16 21:01:47.139076 2026] [:error] [pid 61361:tid 61371] [client 41.59.243.85:53175] [client 41.59.243.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.59.243.85, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aghqu5Zojzbt3jGziNmApAAAAUg"]
[Sat May 16 21:48:55.758941 2026] [:error] [pid 61361:tid 61384] [client 43.156.34.42:43568] [client 43.156.34.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agh1x5Zojzbt3jGziNmGfwAAAVU"]
[Sat May 16 23:35:40.640342 2026] [:error] [pid 24979:tid 24998] [client 129.226.211.69:40750] [client 129.226.211.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agiOzLvSFUQiwLaOL2q38AAAANE"]
[Sun May 17 02:13:59.094618 2026] [:error] [pid 61411:tid 61417] [client 175.27.163.171:38762] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agiz52VkiEwGnPL_dvFEowAAAYQ"]
[Sun May 17 03:00:38.109343 2026] [:error] [pid 24979:tid 24986] [client 92.118.39.29:59858] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agi-1rvSFUQiwLaOL2rMEgAAAMU"]
[Sun May 17 03:50:05.241904 2026] [:error] [pid 59166:tid 59179] [client 20.151.5.99:50496] [client 20.151.5.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "agjKbU_puQ1I47_0UriZDQAAAMs"]
[Sun May 17 04:09:27.074068 2026] [:error] [pid 36652:tid 36660] [client 34.74.25.123:60294] [client 34.74.25.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agjO9zZrzQadnZADvj_0eAAAAQY"]
[Sun May 17 04:59:48.991830 2026] [:error] [pid 59166:tid 59181] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.208.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agjaxE_puQ1I47_0UrilEgAAAM0"], referer: https://www.facebook.com/
[Sun May 17 04:59:50.655675 2026] [:error] [pid 59166:tid 59192] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paramountestate.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agjaxk_puQ1I47_0UrilGgAAANg"], referer: https://www.facebook.com/
[Sun May 17 04:59:50.747396 2026] [:error] [pid 59166:tid 59184] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.208.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agjaxk_puQ1I47_0UrilGwAAANA"], referer: https://paramountestate.com/wp-login.php
[Sun May 17 04:59:52.189027 2026] [:error] [pid 59166:tid 59170] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.208.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agjayE_puQ1I47_0UrilIQAAAMI"], referer: https://paramountestate.com/wp-login.php
[Sun May 17 04:59:54.028540 2026] [:error] [pid 59166:tid 59169] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.208.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agjayk_puQ1I47_0UrilJwAAAME"], referer: https://paramountestate.com/wp-login.php
[Sun May 17 04:59:56.034366 2026] [:error] [pid 59166:tid 59188] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.208.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agjazE_puQ1I47_0UrilLgAAANQ"], referer: https://paramountestate.com/wp-login.php
[Sun May 17 04:59:57.805116 2026] [:error] [pid 59166:tid 59191] [client 143.198.208.93:55755] [client 143.198.208.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.208.93, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agjazU_puQ1I47_0UrilMwAAANc"], referer: https://paramountestate.com/wp-login.php
[Sun May 17 05:04:22.454221 2026] [:error] [pid 59061:tid 59109] [client 43.153.12.58:55262] [client 43.153.12.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agjb1oYS410zAmsYkoLuyAAAAE0"]
[Sun May 17 07:29:37.455756 2026] [:error] [pid 17234:tid 17260] [client 43.165.167.72:50984] [client 43.165.167.72] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agj94dJ4QOrYRCeDR2j9awAAAVg"]
[Sun May 17 08:22:06.329472 2026] [:error] [pid 36652:tid 36664] [client 103.153.183.69:10046] [client 103.153.183.69] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agkKLjZrzQadnZADvj8kegAAAQo"]
[Sun May 17 08:22:06.329565 2026] [:error] [pid 36652:tid 36664] [client 103.153.183.69:10046] [client 103.153.183.69] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agkKLjZrzQadnZADvj8kegAAAQo"]
[Sun May 17 10:00:26.383764 2026] [:error] [pid 36652:tid 36661] [client 43.163.4.179:56822] [client 43.163.4.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agkhOjZrzQadnZADvj8wpAAAAQc"]
[Sun May 17 12:45:01.424990 2026] [:error] [pid 59061:tid 59119] [client 20.189.203.136:5553] [client 20.189.203.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.189.203.136, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "aglHzYYS410zAmsYkoISeAAAAFc"]
[Sun May 17 12:45:02.541561 2026] [:error] [pid 59061:tid 59111] [client 20.189.203.136:5553] [client 20.189.203.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.189.203.136, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aglHzoYS410zAmsYkoISggAAAE8"]
[Sun May 17 12:45:04.133743 2026] [:error] [pid 59061:tid 59120] [client 20.189.203.136:5553] [client 20.189.203.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aglH0IYS410zAmsYkoISjgAAAFg"]
[Sun May 17 13:03:23.753951 2026] [:error] [pid 17234:tid 17246] [client 192.96.159.129:64180] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "aglMG9J4QOrYRCeDR2g_cgAAAUo"]
[Sun May 17 13:46:48.975879 2026] [:error] [pid 59061:tid 59096] [client 92.118.39.29:51230] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "aglWSIYS410zAmsYkoIVnQAAAEA"]
[Sun May 17 14:00:42.560748 2026] [:error] [pid 17234:tid 17236] [client 123.207.65.62:52708] [client 123.207.65.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aglZitJ4QOrYRCeDR2hCBgAAAUA"]
[Sun May 17 14:14:08.070182 2026] [:error] [pid 36652:tid 36677] [client 43.134.224.16:50094] [client 43.134.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "aglcsDZrzQadnZADvj9L8gAAARc"]
[Sun May 17 20:05:43.010493 2026] [:error] [pid 11079:tid 11116] [client 43.156.168.214:50720] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agmvF2eR3-DrxhvUqxHx2QAAAkw"]
[Sun May 17 21:49:19.080055 2026] [:error] [pid 59062:tid 59138] [client 45.129.32.13:46768] [client 45.129.32.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.129.32.13, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agnHXz4V9GkVWmCFmGYynwAAAI8"]
[Sun May 17 21:53:33.741584 2026] [:error] [pid 10835:tid 10875] [client 43.133.253.253:34408] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agnIXUk8lW0-dtknLl8xSAAAAgI"]
[Sun May 17 23:44:06.212384 2026] [:error] [pid 10784:tid 10801] [client 43.159.152.187:50612] [client 43.159.152.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agniRmBWRlKsFkSZGxBW4AAAAYI"]
[Mon May 18 02:32:04.399364 2026] [:error] [pid 59060:tid 59090] [client 192.144.148.122:57340] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agoJpPvwvq3bndkPE4kFoAAAABU"]
[Mon May 18 04:14:18.834435 2026] [:error] [pid 20779:tid 20867] [client 43.153.54.138:58616] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agohmiF3Tl5ZGU-QyEDMGAAAAJU"]
[Mon May 18 04:20:00.631133 2026] [:error] [pid 20777:tid 20786] [client 45.156.128.156:43536] [client 45.156.128.156] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com|F|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "agoi8IHClf0EYFQBeRE9IwAAAAA"]
[Mon May 18 05:03:33.948256 2026] [:error] [pid 20779:tid 20866] [client 20.24.219.111:4677] [client 20.24.219.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.24.219.111, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agotJSF3Tl5ZGU-QyEDTPwAAAJQ"]
[Mon May 18 05:03:35.130202 2026] [:error] [pid 20779:tid 20851] [client 20.24.219.111:4677] [client 20.24.219.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.24.219.111, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agotJyF3Tl5ZGU-QyEDTSAAAAIU"]
[Mon May 18 05:03:36.677433 2026] [:error] [pid 20779:tid 20863] [client 20.24.219.111:4677] [client 20.24.219.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agotKCF3Tl5ZGU-QyEDTVQAAAJE"]
[Mon May 18 06:20:32.187314 2026] [:error] [pid 20779:tid 20856] [client 43.133.220.37:59058] [client 43.133.220.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ago_MCF3Tl5ZGU-QyEDdwwAAAIo"]
[Mon May 18 10:59:59.265959 2026] [:error] [pid 44087:tid 44113] [client 170.106.35.153:47044] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agqAr25HPHbH9GK7l6zFzQAAAdc"]
[Mon May 18 11:27:01.661620 2026] [:error] [pid 36491:tid 36515] [client 45.92.1.211:57534] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agqHBU555B9CZb6D60l4ywAAAVQ"], referer: www.google.com
[Mon May 18 11:27:01.663983 2026] [:error] [pid 36579:tid 36593] [client 45.92.1.211:57557] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agqHBV-aoZxBfgL5vDw6KQAAAEs"], referer: www.google.com
[Mon May 18 11:27:02.663923 2026] [:error] [pid 36493:tid 36568] [client 45.92.1.211:60061] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agqHBgynkzQB5nM668qS7gAAARM"], referer: www.google.com
[Mon May 18 11:27:02.668896 2026] [:error] [pid 36491:tid 36514] [client 45.92.1.211:60056] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agqHBk555B9CZb6D60l4zgAAAVM"], referer: www.google.com
[Mon May 18 11:27:03.667870 2026] [:error] [pid 43916:tid 43942] [client 45.92.1.211:62656] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agqHB9QC236p33zJJvmuQgAAAJI"], referer: www.google.com
[Mon May 18 11:27:03.675019 2026] [:error] [pid 43916:tid 43946] [client 45.92.1.211:62663] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agqHB9QC236p33zJJvmuQwAAAJY"], referer: www.google.com
[Mon May 18 11:27:04.672548 2026] [:error] [pid 44010:tid 44019] [client 45.92.1.211:65144] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agqHCDcFUuogD3-74-ZZDQAAAMc"], referer: www.google.com
[Mon May 18 11:27:04.675339 2026] [:error] [pid 36492:tid 36546] [client 45.92.1.211:65158] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agqHCGCVlogrkn9m2w5zXgAAABg"], referer: www.google.com
[Mon May 18 11:27:05.677482 2026] [:error] [pid 36492:tid 36542] [client 45.92.1.211:51067] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agqHCWCVlogrkn9m2w5zYwAAABQ"], referer: www.google.com
[Mon May 18 11:27:05.677650 2026] [:error] [pid 36579:tid 36591] [client 45.92.1.211:51076] [client 45.92.1.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agqHCV-aoZxBfgL5vDw6LwAAAEk"], referer: www.google.com
[Mon May 18 13:13:46.230038 2026] [:error] [pid 36493:tid 36553] [client 43.165.195.234:35462] [client 43.165.195.234] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agqgCgynkzQB5nM668qfbQAAAQQ"]
[Mon May 18 14:27:09.589421 2026] [:error] [pid 36493:tid 36553] [client 49.233.45.47:55228] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agqxPQynkzQB5nM668qnhwAAAQQ"]
[Mon May 18 15:16:42.797101 2026] [:error] [pid 36491:tid 36507] [client 43.155.157.239:44768] [client 43.155.157.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agq82k555B9CZb6D60mfzwAAAUw"]
[Mon May 18 17:19:35.511151 2026] [:error] [pid 36492:tid 36534] [client 43.155.188.157:46782] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agrZp2CVlogrkn9m2w7A-AAAAAw"]
[Mon May 18 19:16:15.074180 2026] [:error] [pid 43916:tid 43928] [client 170.106.192.3:60022] [client 170.106.192.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agr0_9QC236p33zJJvnJpQAAAIQ"]
[Mon May 18 21:00:09.089344 2026] [:error] [pid 36492:tid 36541] [client 35.253.183.225:57210] [client 35.253.183.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com"] [uri "/.git/config"] [unique_id "agsNWWCVlogrkn9m2w7xGQAAABM"]
[Mon May 18 21:09:25.252428 2026] [:error] [pid 36491:tid 36511] [client 43.153.123.4:43006] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agsPhU555B9CZb6D60nVGgAAAVA"]
[Mon May 18 23:07:13.679049 2026] [:error] [pid 44087:tid 44096] [client 43.130.139.177:43390] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agsrIW5HPHbH9GK7l6wBNQAAAcc"]
[Tue May 19 00:52:01.603673 2026] [:error] [pid 44046:tid 44067] [client 104.208.64.211:4111] [client 104.208.64.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.208.64.211, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agtDsYYF4k2jfXJBXk0M4QAAAZM"]
[Tue May 19 00:52:02.800885 2026] [:error] [pid 44046:tid 44057] [client 104.208.64.211:4111] [client 104.208.64.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.64.211, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agtDsoYF4k2jfXJBXk0M6gAAAYk"]
[Tue May 19 00:52:04.295881 2026] [:error] [pid 44046:tid 44070] [client 104.208.64.211:4111] [client 104.208.64.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agtDtIYF4k2jfXJBXk0M9gAAAZY"]
[Tue May 19 00:55:26.018195 2026] [:error] [pid 36491:tid 36509] [client 43.155.188.157:56708] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agtEfk555B9CZb6D60nzewAAAU4"]
[Tue May 19 03:24:00.421938 2026] [:error] [pid 36492:tid 36526] [client 139.155.126.16:52870] [client 139.155.126.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agtnUGCVlogrkn9m2w45LAAAAAQ"]
[Tue May 19 04:35:48.043799 2026] [:error] [pid 38814:tid 38821] [client 104.208.64.211:6862] [client 104.208.64.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.208.64.211, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "agt4JAvkKuBwP0epzWdCqQAAAMU"]
[Tue May 19 04:35:49.207401 2026] [:error] [pid 38814:tid 38817] [client 104.208.64.211:6862] [client 104.208.64.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.64.211, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agt4JQvkKuBwP0epzWdCswAAAME"]
[Tue May 19 04:35:50.739031 2026] [:error] [pid 38814:tid 38827] [client 104.208.64.211:6862] [client 104.208.64.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agt4JgvkKuBwP0epzWdCvwAAAMs"]
[Tue May 19 04:49:48.903809 2026] [:error] [pid 38699:tid 38755] [client 103.65.237.216:55685] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/sftp-config.json"] [unique_id "agt7bL--Adsw_P-dthYhPAAAAE0"]
[Tue May 19 04:49:49.156197 2026] [:error] [pid 38699:tid 38751] [client 103.65.237.216:55715] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/.vscode/sftp.json"] [unique_id "agt7bb--Adsw_P-dthYhPQAAAEk"]
[Tue May 19 05:16:30.873683 2026] [:error] [pid 38697:tid 38737] [client 43.162.103.213:44790] [client 43.162.103.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "aguBrqXP9pP6Kgt-msSbfwAAABY"]
[Tue May 19 06:31:16.653023 2026] [:error] [pid 46815:tid 46836] [client 20.12.237.107:6158] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aguTNCPnRhJOmA06Lgr9PwAAAVM"]
[Tue May 19 06:31:19.483980 2026] [:error] [pid 38697:tid 38725] [client 20.12.237.107:6231] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aguTN6XP9pP6Kgt-msSqRQAAAAo"]
[Tue May 19 06:31:42.894648 2026] [:error] [pid 38697:tid 38737] [client 20.12.237.107:6260] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aguTTqXP9pP6Kgt-msSqlwAAABY"]
[Tue May 19 06:31:43.696062 2026] [:error] [pid 38697:tid 38728] [client 20.12.237.107:6245] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/min.php"] [unique_id "aguTT6XP9pP6Kgt-msSqmgAAAA0"]
[Tue May 19 06:31:44.563540 2026] [:error] [pid 38699:tid 38749] [client 20.12.237.107:6250] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/filemanager.php"] [unique_id "aguTUL--Adsw_P-dthYyIAAAAEc"]
[Tue May 19 06:31:45.722366 2026] [:error] [pid 46815:tid 46828] [client 20.12.237.107:6161] [client 20.12.237.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.12.237.107, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "aguTUSPnRhJOmA06Lgr9SQAAAUs"]
[Tue May 19 06:31:50.529493 2026] [:error] [pid 46815:tid 46841] [client 20.12.237.107:6161] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tinyfilemanager.php"] [unique_id "aguTViPnRhJOmA06Lgr9XwAAAVg"]
[Tue May 19 06:32:03.137478 2026] [proxy_fcgi:error] [pid 38697:tid 38738] [client 20.12.237.107:6172] AH01071: Got error 'Primary script unknown'
[Tue May 19 06:32:09.835723 2026] [:error] [pid 38697:tid 38738] [client 20.12.237.107:6172] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "aguTaaXP9pP6Kgt-msSq1QAAABc"]
[Tue May 19 06:32:26.812071 2026] [:error] [pid 38705:tid 38791] [client 20.12.237.107:6157] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/index.php"] [unique_id "aguTesg5dNOZ5umN9lsemgAAAJY"]
[Tue May 19 06:32:32.651784 2026] [:error] [pid 38699:tid 38761] [client 20.12.237.107:6191] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "aguTgL--Adsw_P-dthYyUAAAAFM"]
[Tue May 19 06:32:43.803693 2026] [:error] [pid 46896:tid 46900] [client 20.12.237.107:6267] [client 20.12.237.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aguTi6CHyzL3Ci9LGE3kUAAAAYI"]
[Tue May 19 11:10:25.070963 2026] [:error] [pid 38697:tid 38727] [client 43.157.179.227:51434] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agvUoaXP9pP6Kgt-msT7BwAAAAw"]
[Tue May 19 13:15:33.710830 2026] [:error] [pid 46815:tid 46818] [client 43.134.165.242:39882] [client 43.134.165.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agvx9SPnRhJOmA06Lgo_EAAAAUE"]
[Tue May 19 14:59:35.682397 2026] [:error] [pid 38814:tid 38817] [client 202.155.8.152:53271] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKVwvkKuBwP0epzWd_qAAAAME"]
[Tue May 19 14:59:50.170122 2026] [:error] [pid 46896:tid 46898] [client 202.155.8.152:54207] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wordpress/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKZqCHyzL3Ci9LGE1N1QAAAYA"]
[Tue May 19 14:59:55.015453 2026] [:error] [pid 38697:tid 38727] [client 202.155.8.152:57844] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKa6XP9pP6Kgt-msQgBgAAAAw"]
[Tue May 19 15:18:24.405838 2026] [:error] [pid 38705:tid 38784] [client 119.28.100.147:58092] [client 119.28.100.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agwOwMg5dNOZ5umN9ltQqwAAAI8"]
[Tue May 19 15:37:22.652738 2026] [:error] [pid 38697:tid 38726] [client 162.14.66.219:49268] [client 162.14.66.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agwTMqXP9pP6Kgt-msQmbQAAAAs"]
[Tue May 19 17:24:35.738847 2026] [:error] [pid 41573:tid 41598] [client 43.133.41.88:48496] [client 43.133.41.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agwsUy1A2bd6JDSW9RZ0iwAAARc"]
[Tue May 19 18:57:15.784649 2026] [:error] [pid 38705:tid 38784] [client 103.244.178.38:61489] [client 103.244.178.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.244.178.38, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "agxCC8g5dNOZ5umN9ltdRQAAAI8"]
[Tue May 19 19:19:41.222918 2026] [:error] [pid 55881:tid 55892] [client 43.159.152.184:49012] [client 43.159.152.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agxHTe-UExma0LUC7WABFAAAAkk"]
[Tue May 19 21:10:47.424310 2026] [:error] [pid 55881:tid 55896] [client 43.156.168.214:33114] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agxhV--UExma0LUC7WAHdgAAAk0"]
[Wed May 20 00:49:14.957801 2026] [:error] [pid 41573:tid 41580] [client 82.156.34.74:38200] [client 82.156.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agyUii1A2bd6JDSW9Ra9MQAAAQU"]
[Wed May 20 03:12:43.188118 2026] [:error] [pid 55881:tid 55883] [client 43.134.121.208:48452] [client 43.134.121.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agy2K--UExma0LUC7WAhNQAAAkA"]
[Wed May 20 04:22:47.516009 2026] [:error] [pid 36145:tid 36151] [client 175.27.163.171:42150] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agzGl6tS18KtvF2VagspOgAAAQM"]
[Wed May 20 04:48:13.044987 2026] [:error] [pid 36145:tid 36164] [client 194.62.107.32:24937] [client 194.62.107.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "agzMjatS18KtvF2VagsvzQAAARA"]
[Wed May 20 05:32:50.352855 2026] [:error] [pid 57834:tid 57915] [client 43.153.71.132:41446] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "agzXAnTOfwZ09EhqoYD7cAAAApg"]
[Wed May 20 07:36:51.270476 2026] [:error] [pid 59244:tid 59261] [client 43.162.95.192:42856] [client 43.162.95.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "agz0E7xU0SdQQE7pLs3JMQAAAAg"]
[Wed May 20 09:55:40.812911 2026] [:error] [pid 44059:tid 44064] [client 43.153.76.247:39328] [client 43.153.76.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag0UnBfFs-oSOOcyjyxvugAAAQM"]
[Wed May 20 11:56:15.244936 2026] [:error] [pid 41278:tid 41309] [client 43.161.251.162:38516] [client 43.161.251.162] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag0w3_WiNKASEfiGdwaHdAAAAEA"]
[Wed May 20 14:02:32.098803 2026] [:error] [pid 7731:tid 7751] [client 119.28.100.147:39330] [client 119.28.100.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag1OeH9qQlHXbkl2nEuXbgAAAZI"]
[Wed May 20 14:19:32.702252 2026] [:error] [pid 44059:tid 44066] [client 74.249.157.90:10173] [client 74.249.157.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/admin.php"] [unique_id "ag1SdBfFs-oSOOcyjyzLVAAAAQU"]
[Wed May 20 14:22:02.648193 2026] [:error] [pid 41278:tid 41332] [client 104.28.227.186:31134] [client 104.28.227.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "ag1TCvWiNKASEfiGdwaWHAAAAFc"]
[Wed May 20 14:22:03.541451 2026] [:error] [pid 44059:tid 44066] [client 104.28.227.186:31228] [client 104.28.227.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/config"] [unique_id "ag1TCxfFs-oSOOcyjyzMUAAAAQU"]
[Wed May 20 14:34:00.445518 2026] [:error] [pid 7731:tid 7751] [client 34.46.57.55:57357] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag1V2H9qQlHXbkl2nEuegAAAAZI"]
[Wed May 20 14:34:00.842843 2026] [:error] [pid 7664:tid 7688] [client 34.46.57.55:55593] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag1V2HZ8s7o3eiqT2kvOwAAAAVU"]
[Wed May 20 14:34:01.229244 2026] [:error] [pid 7731:tid 7743] [client 34.46.57.55:58972] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2X9qQlHXbkl2nEuevgAAAYo"]
[Wed May 20 15:56:55.489749 2026] [:error] [pid 41279:tid 41338] [client 43.165.197.116:43940] [client 43.165.197.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag1pR7EFyfaehGZbt4x6zwAAAMI"]
[Wed May 20 16:34:07.218036 2026] [:error] [pid 41279:tid 41341] [client 175.27.163.171:50566] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag1x_7EFyfaehGZbt4x9lwAAAMU"]
[Wed May 20 16:49:41.836873 2026] [:error] [pid 44059:tid 44083] [client 146.120.212.154:60722] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ag11pRfFs-oSOOcyjyzvVwAAARY"]
[Wed May 20 17:57:06.623141 2026] [:error] [pid 7664:tid 7675] [client 170.106.148.137:39862] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag2FcnZ8s7o3eiqT2kvogAAAAUg"]
[Wed May 20 19:53:23.177789 2026] [:error] [pid 41279:tid 41358] [client 43.164.3.23:52374] [client 43.164.3.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag2gs7EFyfaehGZbt4yTqAAAANY"]
[Wed May 20 21:07:38.449644 2026] [:error] [pid 44059:tid 44072] [client 195.178.110.105:39672] [client 195.178.110.105] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag2yGRfFs-oSOOcyjywqYAAAAQs"]
[Wed May 20 21:07:38.449740 2026] [:error] [pid 44059:tid 44072] [client 195.178.110.105:39672] [client 195.178.110.105] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag2yGRfFs-oSOOcyjywqYAAAAQs"]
[Wed May 20 21:39:23.498979 2026] [:error] [pid 7664:tid 7677] [client 43.135.36.201:43724] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag25i3Z8s7o3eiqT2ksMfgAAAUo"]
[Thu May 21 00:03:53.318956 2026] [:error] [pid 7664:tid 7670] [client 4.193.203.84:7372] [client 4.193.203.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/requests/src/response/about.php"] [unique_id "ag3baXZ8s7o3eiqT2ksj7gAAAUM"]
[Thu May 21 00:03:54.301685 2026] [:error] [pid 41277:tid 41299] [client 4.193.203.84:10424] [client 4.193.203.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.193.203.84, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ag3barTTCltJmboB5ucYEQAAABE"]
[Thu May 21 00:03:54.764429 2026] [:error] [pid 41277:tid 41290] [client 4.193.203.84:10424] [client 4.193.203.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.193.203.84, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ag3barTTCltJmboB5ucYEwAAAAg"]
[Thu May 21 00:04:02.853602 2026] [:error] [pid 41277:tid 41297] [client 4.193.203.84:10424] [client 4.193.203.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.193.203.84, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ag3bcrTTCltJmboB5ucYLgAAAA8"]
[Thu May 21 00:04:07.863277 2026] [:error] [pid 41277:tid 41302] [client 4.193.203.84:10424] [client 4.193.203.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.193.203.84, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ag3bd7TTCltJmboB5ucYOQAAABQ"]
[Thu May 21 00:04:11.700775 2026] [:error] [pid 41277:tid 41285] [client 4.193.203.84:10424] [client 4.193.203.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ag3be7TTCltJmboB5ucYRQAAAAM"]
[Thu May 21 01:33:43.292028 2026] [:error] [pid 41278:tid 41323] [client 43.157.53.115:52416] [client 43.157.53.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag3wd_WiNKASEfiGdwbXZgAAAE4"]
[Thu May 21 03:42:07.859223 2026] [:error] [pid 7731:tid 7756] [client 20.220.207.50:25574] [client 20.220.207.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/tiny.php"] [unique_id "ag4Oj39qQlHXbkl2nEuAgQAAAZc"]
[Thu May 21 03:42:37.463503 2026] [:error] [pid 7664:tid 7667] [client 20.220.207.50:25565] [client 20.220.207.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com"] [uri "/fm.php"] [unique_id "ag4OrXZ8s7o3eiqT2ktGxgAAAUA"]
[Thu May 21 04:00:50.633667 2026] [:error] [pid 19128:tid 19182] [client 43.130.16.140:41870] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag4S8vcFep7eIHioz7BcIgAAAFc"]
[Thu May 21 04:11:15.519018 2026] [:error] [pid 49982:tid 49999] [client 20.42.42.211:39071] [client 20.42.42.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.42.42.211, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/wp/xmlrpc.php"] [unique_id "ag4VY2FwIDa5Tf8O4bbs5gAAAM8"]
[Thu May 21 04:50:43.066716 2026] [:error] [pid 49879:tid 49934] [client 129.211.172.249:52394] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag4eo4VqYDjFSyG2gFr6EwAAAE4"]
[Thu May 21 06:08:28.518131 2026] [:error] [pid 49884:tid 49951] [client 43.134.5.186:45460] [client 43.134.5.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag4w3K5MPpsTNNHWS6i0mgAAAIQ"]
[Thu May 21 06:11:13.322037 2026] [:error] [pid 49884:tid 49956] [client 5.180.252.43:39660] [client 5.180.252.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "ag4xga5MPpsTNNHWS6i12wAAAIk"]
[Thu May 21 08:14:36.253474 2026] [:error] [pid 49982:tid 49996] [client 129.226.209.117:46284] [client 129.226.209.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag5ObGFwIDa5Tf8O4bZBOgAAAMw"]
[Thu May 21 10:24:11.593348 2026] [:error] [pid 9157:tid 9166] [client 129.226.211.69:38608] [client 129.226.211.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag5sy8GfHcLNqE8m88JLUQAAAYc"]
[Thu May 21 12:23:53.744193 2026] [:error] [pid 49884:tid 49957] [client 43.153.208.32:35634] [client 43.153.208.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag6I2a5MPpsTNNHWS6g5uQAAAIo"]
[Thu May 21 14:35:44.856679 2026] [:error] [pid 49884:tid 49958] [client 43.134.93.181:55694] [client 43.134.93.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag6nwK5MPpsTNNHWS6htyAAAAIs"]
[Thu May 21 15:20:41.600286 2026] [:error] [pid 49884:tid 49961] [client 112.206.243.5:35482] [client 112.206.243.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.206.243.5, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ag6ySa5MPpsTNNHWS6iAfQAAAI4"]
[Thu May 21 16:37:04.894633 2026] [:error] [pid 9188:tid 9192] [client 49.233.45.47:43090] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag7EMLGYm6q5dNSUvA_FdAAAAcA"]
[Thu May 21 18:35:25.381423 2026] [:error] [pid 9157:tid 9176] [client 43.166.1.243:48580] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag7f7cGfHcLNqE8m88KHCQAAAZE"]
[Thu May 21 20:31:35.507773 2026] [:error] [pid 9157:tid 9167] [client 43.156.50.197:49396] [client 43.156.50.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag77J8GfHcLNqE8m88KTVwAAAYg"]
[Thu May 21 22:24:09.408922 2026] [:error] [pid 49982:tid 49986] [client 43.130.34.74:45638] [client 43.130.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag8ViWFwIDa5Tf8O4bYVtAAAAMI"]
[Thu May 21 23:24:10.013040 2026] [:error] [pid 9189:tid 9243] [client 34.150.255.112:62949] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag8jmpvTDh1NbYizKVzVVAAAAhg"]
[Thu May 21 23:24:10.441491 2026] [:error] [pid 49884:tid 49966] [client 34.150.255.112:65345] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXuQAAAJM"]
[Thu May 21 23:24:10.874674 2026] [:error] [pid 9188:tid 9211] [client 34.150.255.112:51877] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jmrGYm6q5dNSUvA__CgAAAdM"]
[Fri May 22 02:50:38.569486 2026] [:error] [pid 9188:tid 9216] [client 43.165.174.53:60868] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag9T_rGYm6q5dNSUvA8WRwAAAdg"]
[Fri May 22 04:41:28.177335 2026] [:error] [pid 58813:tid 58833] [client 49.235.136.28:33652] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag9t-J6yyKWDKULhxJ3uWQAAAVE"]
[Fri May 22 05:15:49.818400 2026] [:error] [pid 15584:tid 15640] [client 43.166.238.12:44228] [client 43.166.238.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag92Bd9Z_TVLbNEx52hulwAAAFQ"]
[Fri May 22 07:23:33.256141 2026] [:error] [pid 58782:tid 58799] [client 43.135.182.43:33356] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag-T9YxsdTFafgO8vhS1PwAAAQ8"]
[Fri May 22 08:18:31.245161 2026] [:error] [pid 58813:tid 58819] [client 176.65.139.235:60106] [client 176.65.139.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env"] [unique_id "ag-g156yyKWDKULhxJ0PIQAAAUM"]
[Fri May 22 09:28:15.706663 2026] [:error] [pid 15679:tid 15705] [client 137.184.135.38:59056] [client 137.184.135.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.135.38, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ag-xLyh8tgGc38WJ-Gyt9gAAANg"]
[Fri May 22 09:28:16.549659 2026] [:error] [pid 15679:tid 15692] [client 137.184.135.38:58118] [client 137.184.135.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.135.38, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ag-xMCh8tgGc38WJ-Gyt-QAAAMs"]
[Fri May 22 09:54:39.351948 2026] [:error] [pid 15585:tid 15665] [client 43.157.98.187:46708] [client 43.157.98.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag-3XyKb-vB41AF-LC2mkQAAAJI"]
[Fri May 22 11:27:19.911808 2026] [:error] [pid 15679:tid 15695] [client 170.64.148.33:50363] [client 170.64.148.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.148.33, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ag_NFyh8tgGc38WJ-GzN-AAAAM4"]
[Fri May 22 11:27:20.011951 2026] [:error] [pid 58782:tid 58804] [client 170.64.148.33:50378] [client 170.64.148.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.148.33, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ag_NGIxsdTFafgO8vhTcCAAAARQ"]
[Fri May 22 11:58:06.574560 2026] [:error] [pid 15584:tid 15644] [client 43.133.91.48:47340] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ag_UTt9Z_TVLbNEx52jIbgAAAFg"]
[Fri May 22 14:15:14.060322 2026] [:error] [pid 15583:tid 15597] [client 170.106.181.163:39812] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ag_0cnnaOncRcIm17YXWnwAAAAk"]
[Fri May 22 14:41:30.681832 2026] [:error] [pid 15585:tid 15671] [client 103.137.93.63:54961] [client 103.137.93.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.137.93.63, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ag_6miKb-vB41AF-LC0TEgAAAJg"]
[Fri May 22 15:41:59.046469 2026] [:error] [pid 15679:tid 15687] [client 192.144.148.122:60038] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahAIxyh8tgGc38WJ-GwZ3gAAAMY"]
[Fri May 22 16:42:31.756896 2026] [:error] [pid 58813:tid 58839] [client 185.198.240.208:49395] [client 185.198.240.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ahAW956yyKWDKULhxJ1m7QAAAVc"]
[Fri May 22 17:06:17.433603 2026] [:error] [pid 15679:tid 15695] [client 161.118.202.128:49190] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file-manager/initialize"] [unique_id "ahAciSh8tgGc38WJ-Gwu9gAAAM4"]
[Fri May 22 17:06:17.627968 2026] [:error] [pid 58782:tid 58799] [client 161.118.202.128:49330] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/file-manager/initialize"] [unique_id "ahAciYxsdTFafgO8vhQNMgAAAQ8"]
[Fri May 22 17:11:07.719875 2026] [:error] [pid 58813:tid 58825] [client 34.93.63.75:59005] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahAdq56yyKWDKULhxJ1rYwAAAUk"]
[Fri May 22 17:11:08.012143 2026] [:error] [pid 15584:tid 15626] [client 34.93.63.75:60246] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdrN9Z_TVLbNEx52gLzwAAAEY"]
[Fri May 22 17:11:08.309104 2026] [:error] [pid 15583:tid 15603] [client 34.93.63.75:61763] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feed/"] [unique_id "ahAdrHnaOncRcIm17YX1LAAAAA8"]
[Fri May 22 18:36:58.649575 2026] [:error] [pid 58813:tid 58834] [client 43.153.208.32:55716] [client 43.153.208.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahAxyp6yyKWDKULhxJ12UgAAAVI"]
[Fri May 22 22:59:18.919702 2026] [:error] [pid 15583:tid 15590] [client 43.159.145.149:49946] [client 43.159.145.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahBvRnnaOncRcIm17YU3dgAAAAI"]
[Sat May 23 02:22:29.110407 2026] [:error] [pid 15585:tid 15668] [client 43.167.239.66:44264] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahCe5SKb-vB41AF-LC3VawAAAJU"]
[Sat May 23 06:55:45.839598 2026] [:error] [pid 30942:tid 31016] [client 43.156.204.134:38542] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahDe8dUosz64YFiBlG3FdAAAAI0"]
[Sat May 23 13:52:48.394556 2026] [:error] [pid 30942:tid 31016] [client 170.106.163.48:53658] [client 170.106.163.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahFAsNUosz64YFiBlG0mWAAAAI0"]
[Sat May 23 15:00:22.591691 2026] [:error] [pid 30940:tid 30950] [client 139.155.134.17:56980] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahFQhpqUP2XZmzp7RDraQQAAAAE"]
[Sat May 23 19:08:55.202732 2026] [:error] [pid 44325:tid 44335] [client 43.153.36.110:36650] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahGKx1gUQb4puB_2yV8VYwAAAYc"]
[Sat May 23 21:31:51.742886 2026] [:error] [pid 44326:tid 44372] [client 43.130.228.73:46456] [client 43.130.228.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahGsR8yrPrcAqE-FOKKq8wAAAdE"]
[Sat May 23 23:55:29.569157 2026] [:error] [pid 31039:tid 31048] [client 43.165.198.144:48864] [client 43.165.198.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahHN8aIYDYo8WvA5zLJg-QAAAMc"]
[Sun May 24 03:05:23.716568 2026] [:error] [pid 44325:tid 44341] [client 1.15.52.154:38172] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahH6c1gUQb4puB_2yV9zGgAAAY0"]
[Sun May 24 03:08:03.759053 2026] [:error] [pid 44296:tid 44304] [client 43.134.40.189:45312] [client 43.134.40.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahH7E5drUdFI6ijvMknVIwAAAUY"]
[Sun May 24 06:24:48.299318 2026] [:error] [pid 50873:tid 50953] [client 43.153.113.127:35566] [client 43.153.113.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahIpMOlYxsqwDcWZbhLOmgAAAI0"]
[Sun May 24 09:36:06.358517 2026] [:error] [pid 49775:tid 49792] [client 43.131.243.61:41634] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahJWBovZb8G6T8WpI1gS7AAAAA8"]
[Sun May 24 12:19:18.088512 2026] [:error] [pid 23497:tid 23504] [client 43.130.34.74:37062] [client 43.130.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahJ8RiPlV47QcYwd2v9yZgAAAUQ"]
[Sun May 24 14:03:35.314491 2026] [:error] [pid 2639:tid 2642] [client 49.234.192.248:38008] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahKUt0zQncQTd0Z0Oe80HwAAAQE"]
[Sun May 24 18:46:55.328656 2026] [:error] [pid 41708:tid 41712] [client 122.172.80.6:12675] [client 122.172.80.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.80.6, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ahLXH_4tQzoTxpuHBF7ODAAAAYI"]
[Sun May 24 23:36:01.019099 2026] [:error] [pid 11280:tid 11301] [client 168.231.103.16:46500] [client 168.231.103.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/backend/.env"] [unique_id "ahMa4YRn5s7laoSxy1QsJAAAAFA"]
[Sun May 24 23:36:03.099634 2026] [:error] [pid 11282:tid 11342] [client 168.231.103.16:46508] [client 168.231.103.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/app/.env"] [unique_id "ahMa4-0bPyN3C7HZ1R_AYQAAAMI"]
[Mon May 25 00:48:18.293549 2026] [:error] [pid 11282:tid 11347] [client 129.226.217.17:53984] [client 129.226.217.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahMr0u0bPyN3C7HZ1R_QuwAAAMc"]
[Mon May 25 03:32:51.369839 2026] [:error] [pid 9303:tid 9353] [client 43.128.149.102:34398] [client 43.128.149.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahNSY33bQScbssitjPQKbgAAAFM"]
[Mon May 25 06:12:09.655510 2026] [:error] [pid 21606:tid 21625] [client 43.166.255.102:58800] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahN3uWswdp0RYkH5t9W_XAAAAVE"]
[Mon May 25 07:09:22.203804 2026] [:error] [pid 9304:tid 9368] [client 104.28.214.122:38773] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com"] [uri "/ms-themes.php"] [unique_id "ahOFIuVEV2qpMC_1UzSV_wAAAIc"]
[Mon May 25 08:00:07.141837 2026] [:error] [pid 62428:tid 62492] [client 172.213.208.33:15743] [client 172.213.208.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/requests/src/response/about.php"] [unique_id "ahORB5NosGBa7mui3VSaLAAAAIg"]
[Mon May 25 08:00:08.106319 2026] [:error] [pid 62722:tid 62740] [client 172.213.208.33:26409] [client 172.213.208.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.213.208.33, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ahORCKM6ssnLWYf6CVA9DAAAAFA"]
[Mon May 25 08:00:08.581875 2026] [:error] [pid 62722:tid 62731] [client 172.213.208.33:26409] [client 172.213.208.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.213.208.33, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ahORCKM6ssnLWYf6CVA9EAAAAEc"]
[Mon May 25 08:00:12.820574 2026] [:error] [pid 62722:tid 62733] [client 172.213.208.33:26409] [client 172.213.208.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.213.208.33, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ahORDKM6ssnLWYf6CVA9NAAAAEk"]
[Mon May 25 08:00:14.987350 2026] [:error] [pid 62722:tid 62738] [client 172.213.208.33:26409] [client 172.213.208.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.213.208.33, incrementing ddos counter"] [hostname "paramountestate.com"] [uri "/xmlrpc.php"] [unique_id "ahORDqM6ssnLWYf6CVA9RAAAAE4"]
[Mon May 25 08:00:17.843146 2026] [:error] [pid 62722:tid 62747] [client 172.213.208.33:26409] [client 172.213.208.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ahOREaM6ssnLWYf6CVA9WwAAAFc"]
[Mon May 25 08:47:59.546085 2026] [:error] [pid 62426:tid 62446] [client 43.157.95.239:45904] [client 43.157.95.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahOcP0j3D3Mo8ANpTRB5awAAABA"]
[Mon May 25 10:05:40.534506 2026] [:error] [pid 62427:tid 62471] [client 98.159.226.57:30547] [client 98.159.226.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.git/HEAD"] [unique_id "ahOudPMUa83fc4GDyBwQewAAAU4"]
[Mon May 25 12:31:35.979663 2026] [:error] [pid 62722:tid 62746] [client 175.178.110.121:36864] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahPQp6M6ssnLWYf6CVDC3QAAAFY"]
[Mon May 25 13:14:50.242724 2026] [:error] [pid 62515:tid 62520] [client 178.128.87.202:52983] [client 178.128.87.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.87.202, incrementing brute counter"] [hostname "paramountestate.com"] [uri "/wp-login.php"] [unique_id "ahPayhig0_XsOwmnrv-0WgAAAMM"]
[Mon May 25 17:38:23.168047 2026] [:error] [pid 53791:tid 53812] [client 43.166.238.12:43270] [client 43.166.238.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahQYjyCRhhNTD40Nf1X5OwAAAZM"]
[Mon May 25 21:30:34.736690 2026] [:error] [pid 62515:tid 62524] [client 43.134.1.185:60812] [client 43.134.1.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahRO-hig0_XsOwmnrv9LGAAAAMc"]
[Mon May 25 23:52:57.816933 2026] [:error] [pid 62427:tid 62479] [client 49.51.195.195:38982] [client 49.51.195.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahRwWfMUa83fc4GDyByVPQAAAVY"]
[Tue May 26 01:29:49.965341 2026] [:error] [pid 62722:tid 62733] [client 124.221.163.189:51124] [client 124.221.163.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahSHDaM6ssnLWYf6CVBwPgAAAEk"]
[Tue May 26 02:10:55.305607 2026] [:error] [pid 62722:tid 62741] [client 43.165.174.53:57234] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahSQr6M6ssnLWYf6CVBznQAAAFE"]
[Tue May 26 05:13:03.460512 2026] [:error] [pid 20025:tid 20078] [client 43.130.16.140:33482] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahS7X37k8Vts-JPOkgWbYQAAAE0"]
[Tue May 26 06:54:01.761357 2026] [:error] [pid 55988:tid 56001] [client 82.156.116.86:37436] [client 82.156.116.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahTTCf3kVIz2sql52sd2fgAAAQo"]
[Tue May 26 08:12:23.457561 2026] [:error] [pid 20125:tid 20149] [client 170.106.140.110:55304] [client 170.106.140.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahTlZ9k9jeWERFDLJc6sdAAAANY"]
[Tue May 26 11:04:21.714797 2026] [:error] [pid 20026:tid 20110] [client 162.62.132.25:58400] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahUNtTXIXIr-5BZ8nR4thgAAAJI"]
[Tue May 26 12:30:37.266687 2026] [:error] [pid 20026:tid 20093] [client 129.211.229.121:36108] [client 129.211.229.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahUh7TXIXIr-5BZ8nR5BbQAAAIE"]
[Tue May 26 13:16:39.418583 2026] [:error] [pid 39336:tid 39346] [client 43.153.10.13:45158] [client 43.153.10.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahUst9wmp9MmyaRNgiAapgAAAUc"]
[Tue May 26 13:23:52.708955 2026] [:error] [pid 20026:tid 20106] [client 77.83.39.186:21138] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp"] [unique_id "ahUuaDXIXIr-5BZ8nR5LggAAAI4"]
[Tue May 26 13:24:39.513002 2026] [:error] [pid 55988:tid 56009] [client 77.83.39.186:22804] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.env"] [unique_id "ahUul_3kVIz2sql52scD6QAAARI"]
[Tue May 26 13:24:53.025176 2026] [:error] [pid 20026:tid 20096] [client 77.83.39.186:50880] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/v1/.env"] [unique_id "ahUupTXIXIr-5BZ8nR5LowAAAIQ"]
[Tue May 26 13:24:55.312283 2026] [:error] [pid 20125:tid 20143] [client 77.83.39.186:50884] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/api/.environment"] [unique_id "ahUup9k9jeWERFDLJc78GgAAANA"]
[Tue May 26 13:24:56.375053 2026] [:error] [pid 20025:tid 20085] [client 77.83.39.186:50902] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/config/.env"] [unique_id "ahUuqH7k8Vts-JPOkgVv3wAAAFQ"]
[Tue May 26 13:24:56.824791 2026] [:error] [pid 20026:tid 20109] [client 77.83.39.186:50914] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/.env.local.php"] [unique_id "ahUuqDXIXIr-5BZ8nR5LqgAAAJE"]
[Tue May 26 13:25:00.985220 2026] [:error] [pid 20024:tid 20046] [client 77.83.39.186:50926] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/apps/.env"] [unique_id "ahUurFdk7QtxEB93NpdeDAAAAAg"]
[Tue May 26 13:25:02.510380 2026] [:error] [pid 39336:tid 39350] [client 77.83.39.186:59224] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/backend/.env"] [unique_id "ahUurtwmp9MmyaRNgiAdrAAAAUs"]
[Tue May 26 17:05:07.926372 2026] [:error] [pid 20025:tid 20068] [client 34.11.17.55:59201] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahViQ37k8Vts-JPOkgXPhwAAAEM"]
[Tue May 26 17:05:08.369818 2026] [:error] [pid 55988:tid 56015] [client 34.11.17.55:57610] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRP3kVIz2sql52sdhpgAAARg"]
[Tue May 26 17:05:08.848887 2026] [:error] [pid 55988:tid 56005] [client 34.11.17.55:56708] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com"] [uri "/feed/"] [unique_id "ahViRP3kVIz2sql52sdhzwAAAQ4"]
[Tue May 26 18:22:40.457558 2026] [:error] [pid 36497:tid 36521] [client 106.52.216.13:46924] [client 106.52.216.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahV0cLjKQWM1gBmBY4icGAAAAMs"]
[Tue May 26 18:34:32.676133 2026] [:error] [pid 33886:tid 33906] [client 49.51.38.193:42522] [client 49.51.38.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahV3OLBYzgp5rPVdHcV0RQAAAE8"]
[Tue May 26 20:23:19.312425 2026] [:error] [pid 36497:tid 36512] [client 52.173.14.114:33437] [client 52.173.14.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com"] [uri "/wp-config.php"] [unique_id "ahWQt7jKQWM1gBmBY4jkvQAAAMI"]
[Tue May 26 20:29:47.240007 2026] [:error] [pid 43701:tid 43703] [client 43.165.125.66:45626] [client 43.165.125.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com"] [uri "/"] [unique_id "ahWSO4WtVI_UGrhtwKCaTwAAAUA"]
[Tue May 26 22:20:24.215589 2026] [:error] [pid 43701:tid 43708] [client 43.135.139.165:46890] [client 43.135.139.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com"] [uri "/"] [unique_id "ahWsKIWtVI_UGrhtwKATKgAAAUU"]